diff --git a/framework/framework/base.ts b/framework/framework/base.ts
index a70f62574..5fdd935d1 100644
--- a/framework/framework/base.ts
+++ b/framework/framework/base.ts
@@ -125,6 +125,7 @@ export default (logger, xff, xhost) => async (ctx: KoaContext, next: Next) => {
         }
     } finally {
         if (!request.websocket) {
+            if (ctx.handler) ctx.vary('Accept');
             if (response.etag && request.headers['if-none-match'] === response.etag) {
                 ctx.response.status = 304;
             } else if (response.redirect && !request.json) {
diff --git a/framework/framework/server.ts b/framework/framework/server.ts
index f168e88a2..42ec1b816 100644
--- a/framework/framework/server.ts
+++ b/framework/framework/server.ts
@@ -401,9 +401,9 @@ export class WebService extends Service<never> {
                         c.set('Access-Control-Allow-Headers', corsAllowHeaders);
                         if (c.request.headers.origin) {
                             c.set('Access-Control-Allow-Origin', c.request.headers.origin);
-                            c.set('Vary', 'Origin');
+                            c.vary('Origin');
                         } else {
-                            c.set('Vary', 'Referer');
+                            c.vary('Referer');
                         }
                         c.cors = true;
                     }