We appear to ignore the Vary header when matching items in the push cache. If a pushed request has "Cookie: val=a", and the pushed response has "Vary: Cookie", and the page makes a request with "Cookie: val=b", the pushed item will be returned.

I built a little test suite thing for this: https://github.com/jakearchibald/http2-push-test/

The test is served at /vary-cookie/, which pushes the response described above.

1. Press the "Set cookie b" button, this sets val=b
2. Press "Fetch with credentials" & observe the console

The result should be "NOT FROM PUSH", but Chrome currently displays the 4 random numbers pushed by the server.