FrontendHaltBrowser internals·Advanced·Conceptual·1 min read
What is the purpose of the Vary: Origin response header alongside CORS?
Short interview answer
It tells caches that the response body or headers differ depending on the request's Origin, preventing a shared cache from serving one origin's CORS-approved response to a different, unapproved origin.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.