Caching · Response header
Vary
Which request headers cause different cached variants of the response.
What is Vary?
Vary tells caches that responses differ depending on the listed request headers — most commonly Accept-Encoding, Accept-Language, or Origin. Without a correct Vary, a CDN might serve a gzip-encoded response to a client that cannot decode it.
Typical usage
Set on any response that varies with request headers. Almost always include Accept-Encoding when compression is enabled.
Examples
Vary: Accept-Encoding, Accept-LanguageCommon gotchas
Adding too many headers to Vary destroys cache hit rate — each unique combination is a separate cache entry.
Also known as
Also commonly written as: vary header · http vary · vary accept-encoding · vary origin · cache vary · Vary ヘッダ. These variants — including plural forms, unhyphenated spellings, and Japanese (ヘッダ) — all refer to the same Vary HTTP header.
Specification
RFC 9110 §12.5.5
Frequently asked questions
What is the Vary HTTP header?
Vary tells caches that responses differ depending on the listed request headers — most commonly Accept-Encoding, Accept-Language, or Origin. Without a correct Vary, a CDN might serve a gzip-encoded response to a client that cannot decode it.
Is Vary a request or response header?
Vary is a response header — the server sends it to the client. Set on any response that varies with request headers. Almost always include Accept-Encoding when compression is enabled.
What does a Vary header look like?
A typical Vary header looks like: Vary: Accept-Encoding, Accept-Language.
What are common mistakes with Vary?
Adding too many headers to Vary destroys cache hit rate — each unique combination is a separate cache entry.
Related headers
Cache-Control
Directives that control caching behavior.
Accept-Encoding
Which content encodings (compressions) the client accepts.
ETag
A version identifier for the resource — the backbone of conditional GETs.
Expires
Declares a wall-clock deadline (HTTP-date) for how long the response stays fresh. Includes exact format, 4 production-ready server configs (Apache, Nginx, Express, CDNs), and the deprecation caveats with Cache-Control.
Age
How many seconds the response has been in a shared cache.