🐛 send Vary Origin for login-webcomponent CORS responses

[ThomasAFink]

Changes

• Add Vary: Origin next to the dynamic CORS header on /src/ and loader scripts so a cached response from one embedder host is not reused on another (button then fails to load). Example: load the button on zms-demo, then open zms-test in another tab — without this, the script is still cached with ACAO for demo and the button disappears on test.
• Use always on the CORS headers
• Also match root loader.js, not only loader-*.js

Reference

Issue: n/a

Checklist

General

• Added meaningful PR title and list of changes in the description

Code

• Wrote code and comments in English
• Removed waste on branch (e.g. console.log), see code quality tooling

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 959984b2-d2f4-4741-af87-b0597622a7d8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}