Vary Header

Last updated: April 2026

The Vary response header tells caches which request headers affect the response content. The cache must store separate copies for each unique combination of those header values.

Common uses

Vary: Accept-Encoding — the most common use. Tells caches to store separate copies for gzip, brotli, and uncompressed responses.

Vary: Accept-Encoding

Vary: Origin — used with CORS. Tells caches to store separate copies per origin so CORS headers are not served to the wrong origin.

Vary: Origin

Vary: Accept — for content negotiation (JSON vs HTML responses from the same URL).

Vary: Accept

Nginx — set Vary for compression

gzip on;
gzip_vary on;  # automatically adds Vary: Accept-Encoding

CORS + Vary: Origin

location /api/ {
    add_header Access-Control-Allow-Origin $http_origin always;
    add_header Vary Origin always;  # critical when origin varies
    proxy_pass http://backend;
}

Verify your Vary header

curl -sI https://yoursite.com | grep -i vary