Cors origin handler missing vary. Closes hapijs#1163

jmonster · Nov 20, 2013 · 83ce09e · 83ce09e
1 parent 417b600
commit 83ce09e
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 5 deletions.
diff --git a/lib/response/headers.js b/lib/response/headers.js
@@ -58,12 +58,15 @@ exports.cors = function (response, request) {
         if (cors._origin.any) {
             response.header('access-control-allow-origin', '*');
         }
-        else if (internals.matchOrigin(request.headers.origin, cors)) {
+        else {
             response.header('vary', 'origin', true);
-            response.header('access-control-allow-origin', request.headers.origin);
-        }
-        else if (cors._origin.qualifiedString && cors.isOriginExposed) {
-            response.header('access-control-allow-origin', cors._origin.qualifiedString);
+
+            if (internals.matchOrigin(request.headers.origin, cors)) {
+                response.header('access-control-allow-origin', request.headers.origin);
+            }
+            else if (cors._origin.qualifiedString && cors.isOriginExposed) {
+                response.header('access-control-allow-origin', cors._origin.qualifiedString);
+            }
         }
     }
 

diff --git a/test/integration/response.js b/test/integration/response.js
@@ -102,6 +102,7 @@ describe('Response', function () {
                 expect(res.result).to.exist;
                 expect(res.result).to.equal('ok');
                 expect(res.headers['access-control-allow-origin']).to.not.exist;
+                expect(res.headers.vary).to.equal('origin');
                 done();
             });
         });