How Vary works
If the server compresses depending on Accept-Encoding, or translates depending on Accept-Language, it must say so in Vary; otherwise a CDN may hand a gzipped response to a client that can’t read it, or French to an English user. Responses that differ by Origin because of CORS need Vary: Origin.
Examples
Vary: Accept-EncodingVary: OriginCommon mistakes
-
Avoid
Vary: User-AgentandVary: Cookieon CDN-cached content: nearly every request has a different value, so the cache hit rate drops to almost zero.
Check it
curl -sI https://example.com | grep -i '^vary:'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- Cache-Control: tells browsers, CDNs and proxies whether a response may be stored, by whom, and for how long.
- Accept-Encoding: lists the compression formats the client can decode.
- Access-Control-Allow-Origin: tells the browser which origin may read a cross-origin response.
More caching headers
ETag , If-None-Match , Last-Modified , If-Modified-Since , Expires , Age .
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the Vary header do?
The Vary response header lists the request headers that change the response, so caches keep a separate copy for each value. If the server compresses depending on Accept-Encoding, or translates depending on Accept-Language, it must say so in Vary; otherwise a CDN may hand a gzipped response to a client that can’t read it, or French to an English user. Responses that differ by Origin because of CORS need Vary: Origin.
How do I see the Vary header?
Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.