.../FunctionalTests/HttpKernel/CorsIntegrationTest.php     | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php b/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php
index cc43936..152c656 100644
--- a/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php
+++ b/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php
@@ -39,21 +39,31 @@ public function testCrossSiteRequest() {
     $this->setContainerParameter('cors.config', $cors_config);
     $this->rebuildContainer();
 
+    // Fire off a request without 'Origin' request header.
+    $this->drupalGet('/test-page');
+    $this->assertSession()->statusCodeEquals(200);
+    $this->assertSession()->responseHeaderEquals('Vary', 'Origin');
+    $this->assertSession()->responseHeaderEquals('X-Drupal-Cache', 'MISS');
+    $this->assertNull($this->getSession()->getResponseHeader('Access-Control-Allow-Origin'));
+
     // Fire off a request.
     $this->drupalGet('/test-page', [], ['Origin' => 'http://example.com']);
     $this->assertSession()->statusCodeEquals(200);
-    $this->assertSession()->responseHeaderEquals('X-Drupal-Cache', 'MISS');
+    $this->assertSession()->responseHeaderEquals('Vary', 'Origin');
+    $this->assertSession()->responseHeaderEquals('X-Drupal-Cache', 'HIT');
     $this->assertSession()->responseHeaderEquals('Access-Control-Allow-Origin', 'http://example.com');
 
     // Fire the same exact request. This time it should be cached.
     $this->drupalGet('/test-page', [], ['Origin' => 'http://example.com']);
     $this->assertSession()->statusCodeEquals(200);
+    $this->assertSession()->responseHeaderEquals('Vary', 'Origin');
     $this->assertSession()->responseHeaderEquals('X-Drupal-Cache', 'HIT');
     $this->assertSession()->responseHeaderEquals('Access-Control-Allow-Origin', 'http://example.com');
 
     // Fire a request for a different origin. Verify the CORS header.
     $this->drupalGet('/test-page', [], ['Origin' => 'http://example.org']);
     $this->assertSession()->statusCodeEquals(200);
+    $this->assertSession()->responseHeaderEquals('Vary', 'Origin');
     $this->assertSession()->responseHeaderEquals('X-Drupal-Cache', 'HIT');
     $this->assertSession()->responseHeaderEquals('Access-Control-Allow-Origin', 'http://example.org');
 
@@ -67,11 +77,13 @@ public function testCrossSiteRequest() {
     /** @var \Symfony\Component\HttpFoundation\Response $response */
     $this->drupalGet('/test-page', [], ['Origin' => 'http://non-valid.com']);
     $this->assertSession()->statusCodeEquals(403);
+    $this->assertNull($this->getSession()->getResponseHeader('Vary'));
     $this->assertSession()->pageTextContains('Not allowed.');
 
     // Specify a valid origin.
     $this->drupalGet('/test-page', [], ['Origin' => 'http://example.com']);
     $this->assertSession()->statusCodeEquals(200);
+    $this->assertSession()->responseHeaderEquals('Vary', 'Origin');
     $this->assertSession()->responseHeaderEquals('Access-Control-Allow-Origin', 'http://example.com');
 
     // Verify POST still functions with 'Origin' header set to site's domain.