ContentSecurityPolicyMiddleware should set Cache-Control: Private if a nonce is rendered

[Jacob Walls]

If a CSP nonce is rendered into a response, the response is no longer suitable for caching. See discussion ​at MDN issue tracker and ​our docs:

Avoid caching full responses that include {{ csp_nonce }} or csp_nonce_attr.

We can make it easier for pages cached with the UpdateCacheMiddleware to do the secure thing by default by having the ContentSecurityPolicyMiddleware set Cache-Control: Private if a nonce has been rendered.

Then, for this case:

If caching is necessary, use a strategy that injects a fresh nonce on each request

Johannes mused about an opt-out mechanism for folks who have done exactly that -- injected a fresh nonce somehow -- e.g. with a class attribute on the middleware to keep the Django 6.0 status quo.

---

Then, for the per-page cache, It's a known flaw that @cache_page runs before middlewares have had a chance to set interesting headers (#15855). So the above won't help. We could simply mention CSP nonces in the same paragraph added in 4ef959ab0c7dde0459041a795359c9bc040df2b7, unless we think it's redundant.

[Jacob Walls]

Worth a release note