#29471: Set-Cookie response is cached for deleting invalid session cookies
-------------------------------------+-------------------------------------
Reporter: Duane Hutchins | Owner: nobody
Type: Bug | Status: new
Component: contrib.sessions | Version: 2.0
Severity: Normal | Resolution:
Keywords: empty session cache | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Duane Hutchins):
Replying to [comment:1 Tim Graham]:
> Isn't the solution to use `@vary_on_cookie` as you said? If you have "a
cache-enabled page which shows different content for users who are logged
in vs not logged in" then you need to use the `Vary: Cookie` header, don't
you?
The SessionMiddleware sets `Vary: Cookie` automatically if the session is
accessed. The bug is that SessionMiddleware is not doing that if the
session cookie is invalid.
When accessing the session object:
* No session cookie => `Vary: Cookie` is set
* Valid session cookie => `Vary: Cookie` is set
* Invalid session cookie => `Vary: Cookie` is not set
Examining
[https://docs.djangoproject.com/en/2.0/_modules/django/contrib/sessions/middleware/#SessionMiddleware
the source code], you can confirm this as true because the
`patch_vary_headers` only happens if the session cookie is valid or
missing.
{{{
# First check if we need to delete this cookie.
# The session should be deleted only if the session is
entirely empty
if settings.SESSION_COOKIE_NAME in request.COOKIES and empty:
response.delete_cookie(
settings.SESSION_COOKIE_NAME,
path=settings.SESSION_COOKIE_PATH,
domain=settings.SESSION_COOKIE_DOMAIN,
)
else:
if accessed:
patch_vary_headers(response, ('Cookie',))
}}}
The end result is that this causes the cache handler to cache invalid-
session responses without `Vary: Cookie`. So, if the cached invalid-
session response was to delete the session cookie, then the cookie is
always deleted on that page -- until the cache is updated.
--
Ticket URL: <https://code.djangoproject.com/ticket/29471#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/071.cad84ef5b86184074624d72cd5c0d75a%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
