caching

`Vary`

Tells caches which request headers were used for content negotiation, so they know to store and serve separate variants keyed by those headers. Missing or wrong Vary causes users to see cached content meant for someone else (wrong language, encoding, or device).

Syntax

Vary: <header-name>[, <header-name>...]  |  Vary: *

Common directives / values

Directive	Purpose
Accept-Encoding	Different variants for gzip/br/identity clients.
Accept-Language	Language-negotiated content.
Accept	Different MIME types negotiated (HTML vs JSON).
User-Agent	Device or browser adaptations — high cache-key cardinality, use sparingly.
Cookie	Personalized responses; typically defeats CDN caching entirely.
Origin	CORS responses that differ per origin.
*	Response varies on unspecified inputs — treat as uncacheable by shared caches.

Examples

Vary: Accept-Encoding

Standard for any gzipped/brotli response to keep encoded variants separate.

Vary: Accept-Encoding, Accept-Language

Combine axes; cache key becomes URL + both header values.

Vary: Origin\nAccess-Control-Allow-Origin: https://app.example.com

CORS best practice: prevents a cached response for site A being served to site B.

Vary: *

Effectively marks the response as uncacheable by any shared cache.

Gotcha

Vary: User-Agent explodes the cache key across every browser build — usually a performance disaster; use only when truly serving distinct payloads. Forgetting Vary: Origin on CORS responses is the #1 source of 'works in Chrome, broken in Safari' CORS bugs.

Related headers

Cache-Control

Directs caching behavior in both requests and responses per RFC 9111, controlling freshness, revalidation, and where the response may be stored. Directives can be combined and are respected by browsers, CDNs, and intermediate proxies.

Accept-Encoding

Client advertisement of which content codings it can decode, letting the server compress the response accordingly. Absence means 'identity only'; an explicit identity;q=0 forbids uncompressed responses.

Access-Control-Allow-Origin

The core CORS response header: names the single origin (or *) permitted to read this response from client-side JavaScript. If missing or non-matching, the browser blocks the response from the calling script.

Content-Encoding

Indicates that the body has been transformed with one or more compressions and must be decoded in reverse order to recover the original payload. Negotiated via the client's Accept-Encoding.

ETag

An opaque identifier for a specific version of a resource, used by clients in conditional requests to avoid re-downloading unchanged bodies. The server compares the ETag against If-None-Match (or If-Match) and returns 304 Not Modified when they match.

← All HTTP headers · HTTP status codes · Fix CORS errors