id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
37280	ContentSecurityPolicyMiddleware should set Cache-Control: Private if a nonce is rendered	Jacob Walls	Django Sprints	"If a CSP nonce is rendered into a response, the response is no longer suitable for caching. See discussion [https://github.com/mdn/content/issues/44021#issuecomment-5210572814 at MDN issue tracker] and [https://docs.djangoproject.com/en/dev/ref/csp/#nonce-generation-and-caching our docs]:

> Avoid caching full responses that include {{ csp_nonce }} or csp_nonce_attr.

We can make it easier for pages cached with the `UpdateCacheMiddleware` to do the secure thing by default by having the `ContentSecurityPolicyMiddleware` set `Cache-Control: Private` ''if'' a nonce has been rendered.

Then, for this case:

> If caching is necessary, use a strategy that injects a fresh nonce on each request

Johannes mused about an opt-out mechanism for folks who have done exactly that -- injected a fresh nonce somehow -- e.g. with a class attribute on the middleware to keep the Django 6.0 status quo.

----
Then, for the per-page cache, It's a known flaw that `@cache_page` runs before middlewares have had a chance to set interesting headers (#15855). So the above won't help. We could simply mention CSP nonces in the same paragraph added in 4ef959ab0c7dde0459041a795359c9bc040df2b7, unless we think it's redundant."	New feature	assigned	Core (Cache system)	dev	Normal		csp nonce	Johannes Maron Tim Schilling Rob Hudson	Unreviewed	0	0	0	0	0	0