Only emit vary origin for CORS wildcard mode

lib/response/headers.js

@@ -59,13 +59,16 @@ exports.cors = function (response, request) {
             response.header('access-control-allow-origin', '*');
         }
         else {
-            response.header('vary', 'origin', true);
-
-            if (internals.matchOrigin(request.headers.origin, cors)) {
+            if (cors._origin.qualifiedString && cors.isOriginExposed) {
+                response.header('access-control-allow-origin', cors._origin.qualifiedString);
+            }
+            else if (internals.matchOrigin(request.headers.origin, cors)) {
                 response.header('access-control-allow-origin', request.headers.origin);
+                response.header('vary', 'origin', true);
             }
-            else if (cors._origin.qualifiedString && cors.isOriginExposed) {
-                response.header('access-control-allow-origin', cors._origin.qualifiedString);
+            else {
+                // Need to provide vary for misses to prevent improper caching of misses
+                response.header('vary', 'origin', true);
             }
         }
     }

lib/server.js

@@ -164,7 +164,10 @@ module.exports = internals.Server = function (/* host, port, options */) {
                     }
                 }
 
-                this.settings.cors._origin.qualifiedString = this.settings.cors._origin.qualified.join(' ');
+                // If there are any wildcards then we have to work in vary origin mode
+                if (!this.settings.cors._origin.wildcards.length) {
+                    this.settings.cors._origin.qualifiedString = this.settings.cors._origin.qualified.join(' ');
+                }
             }
         }
     }

test/integration/response.js

@@ -87,6 +87,26 @@ describe('Response', function () {
             });
         });
 
+        it('not return CORS for no origin without isOriginExposed', function (done) {
+
+            var handler = function () {
+
+                this.reply('ok');
+            };
+
+            var server = new Hapi.Server({ cors: { isOriginExposed: false, origin: ['http://test.example.com', 'http://www.example.com'] } });
+            server.route({ method: 'GET', path: '/', handler: handler });
+
+            server.inject({ url: '/' }, function (res) {
+
+                expect(res.result).to.exist;
+                expect(res.result).to.equal('ok');
+                expect(res.headers['access-control-allow-origin']).to.not.exist;
+                expect(res.headers.vary).to.equal('origin');
+                done();
+            });
+        });
+
         it('hide CORS origin if no match found', function (done) {
 
             var handler = function () {
@@ -115,7 +135,28 @@ describe('Response', function () {
                     .header('vary', 'x-test', true);
             };
 
-            var server = new Hapi.Server({ cors: { origin: ['http://test.example.com', 'http://www.example.com'] } });
+            var server = new Hapi.Server({ cors: { origin: ['http://test.example.com', 'http://www.example.com', 'http://*.a.com'] } });
+            server.route({ method: 'GET', path: '/', handler: handler });
+
+            server.inject({ url: '/', headers: { origin: 'http://www.example.com' } }, function (res) {
+
+                expect(res.result).to.exist;
+                expect(res.result).to.equal('Tada');
+                expect(res.headers['access-control-allow-origin']).to.equal('http://www.example.com');
+                expect(res.headers.vary).to.equal('x-test,origin');
+                done();
+            });
+        });
+
+        it('return matching hide CORS origin', function (done) {
+
+            var handler = function () {
+
+                this.reply('Tada')
+                    .header('vary', 'x-test', true);
+            };
+
+            var server = new Hapi.Server({ cors: {isOriginExposed: false,  origin: ['http://test.example.com', 'http://www.example.com'] } });
             server.route({ method: 'GET', path: '/', handler: handler });
 
             server.inject({ url: '/', headers: { origin: 'http://www.example.com' } }, function (res) {