#28833: "Cache-Control: private" responses should not be cached by server
-----------------------------------------------+------------------------
Reporter: Nathan Vander Wilt | Owner: nobody
Type: Uncategorized | Status: new
Component: Core (Cache system) | Version: 1.8
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-----------------------------------------------+------------------------
If the "Cache-Control: private" directive is set on a response, it must
not be stored in a shared cache. Django's serverside caching system is a
shared cache, but stores such responses anyway.
A response such as
{{{
Cache-Control: private
Content-Type: text/plain
Here is your own special random number: 42
}}}
should be cacheable only by the user's own browser [more or less], but
Django currently reuses the response for subsequent requests from
''anyone''.
Some workarounds might be:
* use @never_cache or similar to ensure a max-age of 0 which **is**
respected by the cache middleware, but also prevents the users own private
cache from storing
* make sure the response varies on something private to the user (i.e.
`Vary: Cookie`) in which case the entry will still be stored in a shared —
but now less accessible — manner
--
Ticket URL: <https://code.djangoproject.com/ticket/28833>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/049.ebf970b74c2dbd7a19639d6fd5fd5617%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
