How to add vary by origin to asp.net options header

user_5175813 0
Viewed 124

I am using cors how to enable vary by origin for options in asp.net? so the options will have vary:origin header. Here is the code I am using

            services.AddCors(options =>
            {
                options.AddPolicy(Origins,
                builder =>
                {
                    builder.SetIsOriginAllowed(origin => ListOfOrigin(origin))
                           .AllowAnyHeader()
                           .AllowAnyMethod()
                           .AllowCredentials()
                           .SetPreflightMaxAge(TimeSpan.FromMinutes(1));
                });
            });
asp.net-core web asp.net c#
1 Answers

According to resource-implementation:

Resources that wish to enable themselves to be shared with multiple Origins but do not respond uniformly with "*" must in practice generate the Access-Control-Allow-Origin header dynamically in response to every request they wish to allow. As a consequence, authors of such resources should send a Vary: Origin HTTP header or provide other appropriate control directives to prevent caching of such responses, which may be inaccurate if re-used across-origins.

If a request may contain a Access-Control-Allow-Origin with different values, then the CDN should always respond with Vary: Origin, even for responses without an Access-Control-Allow-Origin header.

if the requestor doesn't provide a Origin header in their request, or an Origin value that is not one of the allowed ones, the response does not include the Vary: Origin in the response.

user_136559390
Related