title: Why is CloudFront varying CORS headers response based on Accept-Encoding?
body: <p>I'm trying to get CORS to work properly with Amazon S3 + CloudFront.</p>
  
  <p>After setting my CORS Configuration, it seems to work properly:</p>
  
  <pre><code>$ curl -H "Origin: https://app.close.io" -I "https://d4389n07pf8cq.cloudfront.net/built/app.9e1f9ee9.js" -s | grep Access  
  Access-Control-Allow-Origin: https://app.close.io
  Access-Control-Allow-Methods: GET, HEAD
  Access-Control-Max-Age: 3000
  Access-Control-Allow-Credentials: true
  </code></pre>
  
  <p>But when the resource is requested with <code>Accept-Encoding: gzip</code> then the CORS headers aren't returned properly.</p>
  
  <pre><code>$ curl -H "Origin: https://app.close.io" -H "Accept-Encoding: gzip" -I "https://d4389n07pf8cq.cloudfront.net/built/app.9e1f9ee9.js" -s | grep Access 
  (nothing)
  </code></pre>
  
  <p>Why is that?</p>
  
  <p>My CORS configuration looks like this:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"&gt;
      &lt;CORSRule&gt;
          &lt;AllowedOrigin&gt;https://app.close.io&lt;/AllowedOrigin&gt;
          &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
          &lt;AllowedMethod&gt;HEAD&lt;/AllowedMethod&gt;
          &lt;MaxAgeSeconds&gt;3000&lt;/MaxAgeSeconds&gt;
          &lt;AllowedHeader&gt;Authorization&lt;/AllowedHeader&gt;
          &lt;AllowedHeader&gt;Content-*&lt;/AllowedHeader&gt;
          &lt;AllowedHeader&gt;Host&lt;/AllowedHeader&gt;
          &lt;AllowedHeader&gt;Accept-Encoding&lt;/AllowedHeader&gt;
      &lt;/CORSRule&gt;
  &lt;/CORSConfiguration&gt;
  </code></pre>
  
  <p>(I've also tried a CORS configuration with the <code>Accent-Encoding</code> header removed.)</p>
  
  <p>The S3 object itself is gzipped, and has "Metadata" of <code>Content-Encoding: gzip</code>, <code>Cache-Control: public, max-age=31536000</code>, and <code>Content-Type: application/javascript</code>. </p>
  
  <p>I don't understand why CloudFront+S3 CORS isn't working properly when requesting gzip.</p>