fix: vary fallback S3 preflights by request headers

Author: St4NNi

api/src/cors.rs

@@ -133,7 +133,7 @@ impl CorsConfig {
             header::ACCESS_CONTROL_MAX_AGE,
             HeaderValue::from(CORS_MAX_AGE.as_secs()),
         );
-        headers.insert(header::VARY, HeaderValue::from_static("origin"));
+        append_vary_headers(&mut headers, S3_PREFLIGHT_VARY);
         Some(headers)
     }
 
@@ -268,5 +268,9 @@ mod tests {
             headers.get(header::ACCESS_CONTROL_ALLOW_HEADERS).unwrap(),
             &requested
         );
+        assert_eq!(
+            headers.get(header::VARY).unwrap(),
+            "Origin, Access-Control-Request-Method, Access-Control-Request-Headers"
+        );
     }
 }