Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Vary header should includeOrigin header when cors is enabled #533

Closed
Labels
bugSomething isn't workingv2v2 release
Milestone
@rbozan

Description

@rbozan

Search for duplicate issues

  • I already searched, and this issue is not a duplicate.

Issue scope

Other (specify below)

Describe the bug

The package using CORS should also modify the Vary header to include the Origin header as the response changes based on the Origin header. For example:

~ ❯ curl 'https://static.learnfeliz.com/objects/suburban/House.glb' \  -H 'sec-ch-ua-platform: "Android"' \        -H 'Origin: xyz.com' \                         -H 'Referer: http://localhost:5173/' \  -H 'User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Mobile Safari/537.36' \  -H 'sec-ch-ua: "Not A(Brand";v="8", "Chromium";v="132", "Google Chrome";v="132"' \  -H 'DNT: 1' \  -H 'sec-ch-ua-mobile: ?1' -ILHTTP/2 200 date: Sat, 22 Mar 2025 17:37:43 GMTcontent-type: model/gltf-binarycontent-length: 28748accept-ranges: bytesaccess-control-allow-headers: content-type, authorization, originaccess-control-allow-methods: GET, HEAD, OPTIONSaccess-control-allow-origin: xyz.comaccess-control-expose-headers: content-type, origincache-control: public, max-age=604800, s-maxage=604800, stale-while-revalidate=432000content-security-policy: frame-ancestors 'self'last-modified: Sun, 02 Feb 2025 16:07:36 GMTstrict-transport-security: max-age=63072000; includeSubDomains; preloadvary: accept-encodingx-content-type-options: nosniffx-frame-options: DENYcf-cache-status: MISSreport-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3dPHn1b5FUB3FryKKdHEGPWgIlB94RQFcRekCKH4JD8g1wYsGH9cUdzMkFH2%2BvdDD%2BE2GxVqlnTZDDMVYmpOj8Nk84Ou%2B3oXo8yD%2FOsXWHDbZtvgvkHerMlegZoRMYWlZsbnsOdOFSTmkrdTaGj30kEoyK8%3D"}],"group":"cf-nel","max_age":604800}nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server: cloudflarecf-ray: 92477567284ffe9f-AMSalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=6188&min_rtt=6057&rtt_var=1351&sent=6&recv=8&lost=0&retrans=0&sent_bytes=3433&recv_bytes=1020&delivery_rate=650056&cwnd=253&unsent_bytes=0&cid=3f4c0868dbf530e1&ts=56&x=0"~ ❯ curl 'https://static.learnfeliz.com/objects/suburban/House.glb' \  -H 'sec-ch-ua-platform: "Android"' \  -H 'Referer: http://localhost:5173/' \  -H 'User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Mobile Safari/537.36' \  -H 'sec-ch-ua: "Not A(Brand";v="8", "Chromium";v="132", "Google Chrome";v="132"' \  -H 'DNT: 1' \  -H 'sec-ch-ua-mobile: ?1' -ILHTTP/2 200 date: Sat, 22 Mar 2025 17:37:52 GMTcontent-type: model/gltf-binary~ ❯ curl 'https://static.learnfeliz.com/objects/suburban/House.glb' \  -H 'sec-ch-ua-platform: "Android"' \        -H 'Origin: foobar.com' \         -H 'Referer: http://localhost:5173/' \                                                                                                                  -H 'User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Mobile Safari/537.36' \  -H 'sec-ch-ua: "Not A(Brand";v="8", "Chromium";v="132", "Google Chrome";v="132"' \  -H 'DNT: 1' \                  -H 'sec-ch-ua-mobile: ?1' -ILHTTP/2 200 date: Sat, 22 Mar 2025 17:40:56 GMTcontent-type: model/gltf-binarycontent-length: 28748accept-ranges: bytesaccess-control-allow-headers: content-type, authorization, originaccess-control-allow-methods: GET, HEAD, OPTIONSaccess-control-allow-origin: foobar.comaccess-control-expose-headers: content-type, origincache-control: public, max-age=604800, s-maxage=604800, stale-while-revalidate=432000content-security-policy: frame-ancestors 'self'last-modified: Sun, 02 Feb 2025 16:07:36 GMTstrict-transport-security: max-age=63072000; includeSubDomains; preloadvary: accept-encodingx-content-type-options: nosniffx-frame-options: DENYcf-cache-status: MISSreport-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qHFe%2FWUKIhsriET3FdSaqP55ceC8E5j5FV3WxLGf3u8dOiav6J5XNVmTL1ELzrO4scprZHZNAbfpJmK7VZqJYFLsWog3YdK3YnC%2BE3htOJsWtjhG0B%2FNx99LZfkT5Orn%2FzResxE42AHtAPHQhVXYJROOXxY%3D"}],"group":"cf-nel","max_age":604800}nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server: cloudflarecf-ray: 92477a1ff89b0e30-AMSalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=5668&min_rtt=5277&rtt_var=2111&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3409&recv_bytes=1021&delivery_rate=519593&cwnd=180&unsent_bytes=0&cid=a3b3ea1f408503d2&ts=69&x=0"

content-length: 28748
accept-ranges: bytes
cache-control: public, max-age=604800, s-maxage=604800, stale-while-revalidate=432000
content-security-policy: frame-ancestors 'self'
last-modified: Sun, 02 Feb 2025 16:07:36 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: accept-encoding
x-content-type-options: nosniff
x-frame-options: DENY
age: 2638
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=UrAX3a37N5Bni6sTWHP%2BIb8f6%2F48XN3kHOdcjGexHTwYUbE1X7ebTQg%2ByLajiwl7uVVgtOrb%2FQXFxy1hFfJvwmXWhSmGqS92RDkWTAgN7VsBgy3owHV7JzQ9ZTeHjV8slVcNucLDJDN1QBOj8uY0KE%2Bxp1I%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 924775a00e171cae-AMS
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=5675&min_rtt=4501&rtt_var=1891&sent=6&recv=8&lost=0&retrans=0&sent_bytes=3411&recv_bytes=1006&delivery_rate=762874&cwnd=202&unsent_bytes=0&cid=83091922d76f1690&ts=53&x=0"

How to reproduce it

See above

Expected behavior

It should include the Origin header

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingv2v2 release

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions


      [8]ページ先頭

      ©2009-2025 Movatter.jp