"Cache-Control: private" responses should not be cached by server

[Nathan Vander Wilt]

If the "Cache-Control: private" directive is set on a response, it must not be stored in a shared cache. Django's serverside caching system is a shared cache, but stores such responses anyway.

A response such as

Cache-Control: private
Content-Type: text/plain

Here is your own special random number: 42

should be cacheable only by the user's own browser [more or less], but Django currently reuses the response for subsequent requests from anyone.

Some workarounds might be:

• use @never_cache or similar to ensure a max-age of 0 which is respected by the cache middleware, but also prevents the users own private cache from storing
• make sure the response varies on something private to the user (i.e. Vary: Cookie) in which case the entry will still be stored in a shared — but now less accessible — manner

[shangdahao]

​PR

[Tim Graham <timograham@…>]

In d968788b:

Fixed #28833 -- Prevented CacheMiddleware from caching responses with "Cache-Control: private".