I think that the "Vary" header is misused/heavily used


#1

Why do we use a “Vary” header for CSRF and CORS? Won’t it lead to saving too many copies of the same page?