title: Should you set 'Vary: Origin' when allowing any CORS origin (*)?
body: <p>For a server supporting CORS and wanting to handle caching as efficiently as possible, is it necessary to set <code>Vary: Origin</code> if you know that CORS responses will never vary according to the request origin via <code>Access-Control-Allow-Origin: *</code>?</p>
  
  <p>I've read several guides on the subject, and most recommend using <code>Vary: Origin</code>, but in the common CORS case of explicitly allowing any origin, this seems inefficient and unnecessary.</p>
  
  <p>Thanks!</p>