When the Cache-Control header is set to no-store, the response is cached.

[mengxun]

settings.py

...
MIDDLEWARE = [
    "django.middleware.cache.UpdateCacheMiddleware", 
    "django.middleware.common.CommonMiddleware",
    "django.middleware.cache.FetchFromCacheMiddleware", 
]
...

views.py

from django.http import HttpResponse
import datetime

def cache_demo(request):
    resp = HttpResponse(f"Current content at {datetime.datetime.now()}")
    resp["Cache-Control"] = "no-store"
    return resp

Based on the example above, when the Cache-Control header is set to no-store, the response content is still cached.

[Sarah Boyce]

Similar to #28833, can work around by using @never_cache

[Jagadesha NH]

I can work on these changes

[Jagadesha NH]

Seems like, someone has already raised a PR

[Sarah Boyce <42296566+sarahboyce@…>]

In ed7c1a56:

Fixed #36560 -- Prevented UpdateCacheMiddleware from caching responses with Cache-Control 'no-cache' or 'no-store'.

[Natalia <124304+nessita@…>]

In 366d9ae:

[5.2.x] Fixed CVE-2026-8404 -- Used Cache-Control directives case-insensitively in UpdateCacheMiddleware.

Thanks Ahmed Badawe for the report, and Jacob Walls for reviews.

This commit includes:

[5.2.x] Fixed #36560 -- Prevented UpdateCacheMiddleware from caching responses with Cache-Control 'no-cache' or 'no-store'.

Backport of ed7c1a56400d64f109f30df3ce697984cdad7c75 from main.

Backport of d618d7ae4fec727d5b582bd24f803c28d17bf7cd from main.

[Jacob Walls <jacobtylerwalls@…>]

In 142b881:

Refs #36560, CVE-2026-35193 -- Replaced substring check on cache-control directives in UpdateCacheMiddleware.

Avoid false positives from hypothetical extension directives
that could be superstrings of the ones we are checking.

[Jacob Walls <jacobtylerwalls@…>]

In b615947:

[6.1.x] Refs #36560, CVE-2026-35193 -- Replaced substring check on cache-control directives in UpdateCacheMiddleware.

Avoid false positives from hypothetical extension directives
that could be superstrings of the ones we are checking.

Backport of 142b881cecaddc334cabec139e701c0e4b9798da from main.

[nessita <124304+nessita@…>]

In b461519b:

Refs #36560, CVE-2026-35193 -- Recognized qualified cache-control directives.

The switch from substring matching to exact token membership in
142b881cecaddc334cabec139e701c0e4b9798da caused qualified directive
forms permitted by RFC 9111 (e.g. Cache-Control: private="Set-Cookie")
to be missed, allowing such responses to be stored in a shared cache.

This work added a new split_directive_names() helper that yields the
lowercased directive name from each token, dropping any qualified value
and stripping whitespace around "=", so qualified forms reduce to their
directive name. UpdateCacheMiddleware now uses it so private,
no-cache, and no-store (and the public exception for
Authorization) match regardless of qualified form.

Aligned ConditionalGetMiddleware.needs_etag() to use the same helper,
since it relied on the same brittle exact-token check. Sharing one
helper keeps the two directive lookups consistent and means malformed
input (e.g. no-store="x") now correctly suppresses the ETag instead
of being silently ignored.

Also stripped whitespace around = in patch_cache_control's directive
parsing so a qualified directive with stray whitespace is still recognized.

Thanks to Jacob Walls for reviews.

[Natalia <124304+nessita@…>]

In 27f74d0:

[6.1.x] Refs #36560, CVE-2026-35193 -- Recognized qualified cache-control directives.

The switch from substring matching to exact token membership in
142b881cecaddc334cabec139e701c0e4b9798da caused qualified directive
forms permitted by RFC 9111 (e.g. Cache-Control: private="Set-Cookie")
to be missed, allowing such responses to be stored in a shared cache.

This work added a new split_directive_names() helper that yields the
lowercased directive name from each token, dropping any qualified value
and stripping whitespace around "=", so qualified forms reduce to their
directive name. UpdateCacheMiddleware now uses it so private,
no-cache, and no-store (and the public exception for
Authorization) match regardless of qualified form.

Aligned ConditionalGetMiddleware.needs_etag() to use the same helper,
since it relied on the same brittle exact-token check. Sharing one
helper keeps the two directive lookups consistent and means malformed
input (e.g. no-store="x") now correctly suppresses the ETag instead
of being silently ignored.

Also stripped whitespace around = in patch_cache_control's directive
parsing so a qualified directive with stray whitespace is still recognized.

Thanks to Jacob Walls for reviews.

Backport of b461519bf5973d7fc149560d2f99acdba71a437d from main.