Repository: vert-x3/vertx-web
Issue: CORS headers not set on response for .* origin

### Version

VertX 4.3.6

### Context

On a HTTP-Request without `Origin` i would expect the CORS-Handler to set `Vary:Origin` and this was the case with 3.4.5. 
I'm not 100% sure about the CORS spec itself but considering that the Requests could be cached and looking at -> https://fetch.spec.whatwg.org/#cors-protocol-and-http-caches it seems to me that the previous behavior was the correct one.

### Do you have a reproducer?

no

### Steps to reproduce

1. ` Router.router(vertx).route().handler(CorsHandler.create().addRelativeOrigin(".*").allowedMethod(GET))`
2. `router.get("/path").handler(rc -> rc.end("hello"));`
3. Call with a HttpClient asserting `ctx.assertNotNull(response.getHeaders().get(HttpHeaders.VARY))`

### Extra

* OpenJDK 19


Changed files:
vertx-web/src/test/java/io/vertx/ext/web/handler/CORSHandlerTest.java, vertx-web/src/main/java/io/vertx/ext/web/handler/impl/CorsHandlerImpl.java

diff --git a/vertx-web/src/main/java/io/vertx/ext/web/handler/impl/CorsHandlerImpl.java b/vertx-web/src/main/java/io/vertx/ext/web/handler/impl/CorsHandlerImpl.java
index 4df0ebfd5..1b938687d 100644
--- a/vertx-web/src/main/java/io/vertx/ext/web/handler/impl/CorsHandlerImpl.java
+++ b/vertx-web/src/main/java/io/vertx/ext/web/handler/impl/CorsHandlerImpl.java
@@ -234,7 +234,8 @@ public class CorsHandlerImpl implements CorsHandler {
 
       } else {
         // when it is possible to determine if only one origin is allowed, we can skip this extra caching header
-        if (!starOrigin() && !uniqueOrigin()) {
+        // If allow credentials is set, the response cannot be '*' thus we need to vary on origin
+        if (!(starOrigin() && !allowCredentials) && !uniqueOrigin()) {
           Utils.appendToMapIfAbsent(response.headers(), VARY, ",", ORIGIN);
         }
         addCredentialsAndOriginHeader(response, origin);
diff --git a/vertx-web/src/test/java/io/vertx/ext/web/handler/CORSHandlerTest.java b/vertx-web/src/test/java/io/vertx/ext/web/handler/CORSHandlerTest.java
index 3dfe5dfc6..21c968b01 100644
--- a/vertx-web/src/test/java/io/vertx/ext/web/handler/CORSHandlerTest.java
+++ b/vertx-web/src/test/java/io/vertx/ext/web/handler/CORSHandlerTest.java
@@ -694,6 +694,30 @@ public class CORSHandlerTest extends WebTestBase {
   public void testCORSSetupStarOriginShouldNotHaveVary() throws Exception {
     // when we allow any origin, the response is not dependent on it, so we tell caches not to consider origin in
     // the cache key
+    router
+      .route()
+      .handler(CorsHandler.create()
+        .allowCredentials(false)
+        .allowedHeader("Content-Type")
+        .allowedMethod(HttpMethod.GET)
+        .allowedMethod(HttpMethod.POST)
+        .allowedMethod(HttpMethod.OPTIONS)
+        .allowedHeader("Access-Control-Allow-Origin"))
+      .handler(BodyHandler.create().setBodyLimit(1))
+      .handler(context -> context.response().end());
+
+    testRequest(HttpMethod.POST, "/", req -> {
+      req.headers().add("origin", "https://mydomain.org:3000");
+    }, resp -> {
+      assertNull(resp.getHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS));
+      assertNotNull(resp.getHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN));
+      assertNull(resp.getHeader(HttpHeaders.VARY));
+    }, 200, "OK", null);
+  }
+
+  @Test
+  public void testCORSSetupStarOriginWithAllowCredentialsShouldHaveVary() throws Exception {
+    // When allow credentials is set with any origin, the response is dependent on the origin
     router
       .route()
       .handler(CorsHandler.create()
@@ -711,7 +735,7 @@ public class CORSHandlerTest extends WebTestBase {
     }, resp -> {
       assertNotNull(resp.getHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS));
       assertNotNull(resp.getHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN));
-      assertNull(resp.getHeader(HttpHeaders.VARY));
+      assertEquals("origin", resp.getHeader(HttpHeaders.VARY));
     }, 200, "OK", null);
   }
 }