.../Drupal/Core/EventSubscriber/FinishResponseSubscriber.php |  5 +++++
 .../FunctionalTests/HttpKernel/CorsIntegrationTest.php       | 12 ++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/core/lib/Drupal/Core/EventSubscriber/FinishResponseSubscriber.php b/core/lib/Drupal/Core/EventSubscriber/FinishResponseSubscriber.php
index 747262c..58f02cf 100644
--- a/core/lib/Drupal/Core/EventSubscriber/FinishResponseSubscriber.php
+++ b/core/lib/Drupal/Core/EventSubscriber/FinishResponseSubscriber.php
@@ -131,6 +131,11 @@ public function onRespond(FilterResponseEvent $event) {
     $response->headers->set('X-Content-Type-Options', 'nosniff', FALSE);
     $response->headers->set('X-Frame-Options', 'SAMEORIGIN', FALSE);
 
+    // Always vary by the 'Origin' response header until the asm89/stack-cors
+    // library is fixed.
+    // @todo Remove this when https://github.com/asm89/stack-cors/issues/49 lands and Drupal core updates to a new release.
+    $response->setVary(array_merge($response->getVary(), ['Origin']));
+
     // If the current response isn't an implementation of the
     // CacheableResponseInterface, we assume that a Response is either
     // explicitly not cacheable or that caching headers are already set in
diff --git a/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php b/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php
index 152c656..fcbf4ff 100644
--- a/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php
+++ b/core/tests/Drupal/FunctionalTests/HttpKernel/CorsIntegrationTest.php
@@ -21,6 +21,18 @@ class CorsIntegrationTest extends BrowserTestBase {
    */
   public static $modules = ['system', 'test_page_test', 'page_cache'];
 
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp() {
+    parent::setUp();
+
+    // Enable page caching.
+    $config = $this->config('system.performance');
+    $config->set('cache.page.max_age', 3600);
+    $config->save();
+  }
+
   public function testCrossSiteRequest() {
     // Test default parameters.
     $cors_config = $this->container->getParameter('cors.config');