-
simonw Cloudflare FWIW, I’ve also had this problen when putting the same AWS CloudFront in front of S3 for both staging and production. (It would cache the staging origin and break production CORS). We ended up using separate CloudFronts instead of hassling with Vary—if that’s even possible.