From a16856f52523fe44df0439870fa09c6b3cd5c939 Mon Sep 17 00:00:00 2001 From: Mathieu Leplatre Date: Wed, 14 Oct 2026 13:48:35 +0200 Subject: [PATCH] fix(google_fastly_waf) Do not serve GET cached responses on OPTIONS requests --- google_fastly_waf/vcl/main.vcl.tftpl | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/google_fastly_waf/vcl/main.vcl.tftpl b/google_fastly_waf/vcl/main.vcl.tftpl index 556c9dba..fe3f12a6 100644 --- a/google_fastly_waf/vcl/main.vcl.tftpl +++ b/google_fastly_waf/vcl/main.vcl.tftpl @@ -30,6 +30,13 @@ if (fastly.ff.visits_this_service == 0 && req.restarts == 0) { set req.http.ohfp = fastly_info.oh_fingerprint; } +# Only cache GET and HEAD (like Fastly's boilerplate VCL). `lookup` turns other methods +# into a GET on miss, and the cache key ignores the method: CORS preflights (OPTIONS) +# would receive the cached GET response, without `Access-Control-Allow-Headers/Methods`. +# ref: https://www.fastly.com/documentation/guides/vcl/using/#custom-vcl +if (req.method != "GET" && req.method != "HEAD" && req.method != "FASTLYPURGE") { + return(pass); +} %{ if length(cache_header) > 0 } # If a header is set return caching