Web Security · Middle · Question 34 of 75
When the response depends on the request Origin, which header should the server add?
- 1
Access-Control-Max-Age: 0 - ✓Correct answer:
Vary: Origin - 3
Cache-Control: public
Explanation
Without Vary: Origin, a CDN or browser cache can serve a response with one origin's CORS headers to another origin.