Changes between Initial Version and Version 1 of Ticket #19649


Ignore:
Timestamp:
Jan 21, 2013, 1:17:41 PM (11 years ago)
Author:
Carl Meyer
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #19649 – Description

    initial v1  
    11The cookie storage backend for contrib.messages does not set Vary: Cookie on the response, which means that (in the absence of CSRF protection or sessions or other bits of Django that are likely to set Vary: Cookie) it is possible for users behind a cache to miss messages intended for them, or even for a cache to store a page with a message intended for a single user on it and then serve that page to other users.
    22
    3 In practice, it is quite likely that the cookie message store is used along with CSRF protection or contrib.messages, in which case Vary: Cookie will be set on most responses anyway, rendering this issue moot.
     3In practice, it is quite likely that the cookie message store is used along with CSRF protection or contrib.session, in which case Vary: Cookie will be set on most responses anyway, rendering this issue moot.
    44
    55A case could be made that the correct fix here is at an even deeper level; that any access of request.cookies should automatically trigger Vary: Cookie on the response. This follows the same logic as the current behavior of SessionMiddleware to set Vary: Cookie on any response where the session is accessed, but pushes that logic down to the common cookie layer where it really belongs, rather than duplicating it in the cookie message storage. If you are accessing cookies at all on the server side, presumably that means you are making some decision based on the cookie that might affect the response in some way, and if so Vary: Cookie must be set or the response might be cached incorrectly.
Back to Top