Why add Vary on Access-Control-Request-Method, ACRH and origin when OPTIONS method is not cacheable?

Question

I found go implementation of CORS and it adds on every CORS request following headers:

headers.Add("Vary", "Origin")
headers.Add("Vary", "Access-Control-Request-Method")
headers.Add("Vary", "Access-Control-Request-Headers")

But as far as I know OPTIONS method is not cacheable?

So why they add that Vary header?

user_10256256 · Answer

OPTIONS method can be cached by intermediary caches.

For example:

If you want OPTIONS responses to be cached, do the following:(...)