After upgrading from Spring Boot 3.1.* to Spring Boot 3.2.0 which includes Spring Security 6.2.0, responses of REST services provided by @Controller classes have Vary headers if org.springframework.boot:spring-boot-starter-security is in classpath.

Is this intended? We immediately noticed this change since our CDN Akamai does not cache responses with this header.