{"record":{"id":"a0d6f21a512a6675","repo":"honojs/hono","slug":"middleware-vary-configuration-cannot-include","errorCode":null,"errorMessage":"Middleware vary configuration cannot include \"*\", as it disallows effective caching.","messagePattern":"Middleware vary configuration cannot include \"\\*\", as it disallows effective caching\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/middleware/cache/index.ts","lineNumber":220,"sourceCode":"    reportCacheNotAvailable(\n      options.onCacheNotAvailable,\n      'Cache Middleware cannot cache QUERY requests because Web Crypto is not available.'\n    )\n  }\n\n  if (options.wait === undefined) {\n    options.wait = false\n  }\n\n  const cacheControlDirectives = options.cacheControl\n    ?.split(',')\n    .map((directive) => directive.toLowerCase())\n  const optionsVaryList = parseVaryDirectives(options.vary)\n  const varyDirectives = optionsVaryList.length ? new Set(optionsVaryList) : undefined\n  // RFC 7231 Section 7.1.4 specifies that \"*\" is not allowed in Vary header.\n  // See: https://datatracker.ietf.org/doc/html/rfc7231#section-7.1.4\n  if (varyDirectives?.has('*')) {\n    throw new Error(\n      'Middleware vary configuration cannot include \"*\", as it disallows effective caching.'\n    )\n  }\n\n  const cacheableStatusCodes = new Set<number>(\n    options.cacheableStatusCodes ?? defaultCacheableStatusCodes\n  )\n  const maxQueryBodySize = options.maxQueryBodySize ?? defaultMaxQueryBodySize\n\n  const addHeader = (c: Context, responseVary: string[]) => {\n    if (cacheControlDirectives) {\n      const existingDirectives =\n        c.res.headers\n          .get('Cache-Control')\n          ?.split(',')\n          // Directive names are case-insensitive (RFC 7234 §5.2); lower-case so\n          // the case-insensitive de-dup check below matches handler-set names\n          // like `Max-Age`.","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/honojs/hono/blob/e2740d5a1bd0b4254e517e3af8b60789284bc7bd/src/middleware/cache/index.ts#L202-L238","documentation":"This error is thrown by Hono's cache() middleware when the vary configuration contains the wildcard '*'. RFC 7231 Section 7.1.4 disallows '*' in the Vary header because it tells caches the response varies by unspecified request aspects, making effective caching impossible. The middleware validates directives up front and fails fast at configuration time rather than emitting an invalid header at runtime.","triggerScenarios":"Calling cache({ cacheName: 'x', vary: '*' }); building vary from user input that may contain '*'; splitting a comma string like '*, Accept-Encoding' and passing the array; copying a Vary header value from an upstream service into options.vary without filtering.","commonSituations":"Passing a raw header value collected from another response into vary, dynamic vary lists where '*' sneaks in, misunderstanding that the option takes concrete header names only (e.g. 'Accept-Encoding', 'Accept-Language').","solutions":["Replace '*' with the concrete request headers the response actually depends on","If vary comes from external input, filter out '*' (case-insensitive) before passing it","Use the array form for clarity: vary: ['Accept-Encoding', 'Accept-Language']","If you truly cannot enumerate the varying headers, omit vary entirely instead of using '*'"],"exampleFix":"// before\napp.get('/data', cache({ cacheName: 'my-cache', vary: '*' }))\n\n// after\napp.get('/data', cache({ cacheName: 'my-cache', vary: ['Accept-Encoding', 'Accept-Language'] }))","handlingStrategy":"validation","validationCode":"const sanitizeVary = (vary: string[]): string[] =>\n  vary.map((d) => d.trim().toLowerCase()).filter((d) => d !== '*')\n\nconst mw = cache({ cacheName: 'x', vary: sanitizeVary(userVary) })","typeGuard":"const isValidVary = (vary: string[]): boolean =>\n  vary.every((d) => /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(d) && d !== '*')","tryCatchPattern":null,"preventionTips":["Never pass unfiltered upstream Vary header values into options.vary","Prefer explicit arrays of header names over comma-joined strings","Document which request headers your cached responses actually depend on"],"tags":["cache","vary","rfc-7231","middleware","configuration"],"backgroundTag":"invalid-http-header-configuration","analyzedSha":"e2740d5a1bd0b4254e517e3af8b60789284bc7bd","analyzedAt":"2026-08-28T10:18:08.750Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}