Issue #3001809: CORS breaks with cache proxies and same origin usage.

core/lib/Drupal/Core/EventSubscriber/FinishResponseSubscriber.php

@@ -201,6 +201,10 @@ public function onRespond(ResponseEvent $event) {
       // header declaring the response as not cacheable.
       $this->setResponseNotCacheable($response, $request);
     }
+
+    // Always vary by the 'Origin' response header until the asm89/stack-cors
+    // library is fixed.
+    $response->setVary(array_merge($response->getVary(), ['Origin']));
   }
 
   /**