#29971: Sessions setting vary cookie without providing a cookie
-------------------------------------+-------------------------------------
Reporter: Jd Collins | Owner: Jd
Type: | Collins
Cleanup/optimization | Status: assigned
Component: contrib.sessions | Version: 2.1
Severity: Normal | Resolution:
Keywords: Sessions Vary | Triage Stage:
Header Cookie | Someday/Maybe
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Jd Collins):
Yes I did plan to try a patch, and did create one. After creating the
patch I ran the tests and found one failing test. Before continuing on at
this point I decided to think about the importance of the test and the
impact my solution could have before writing tests that fit my approach. I
came to the conclusion that it may be logical to always provide Vary:
Cookie when using sessions and auth even if the session is not
authenticated and empty. The problem with trying to not provide this
header if the session is anonymous and empty is the cached response would
also then apply to authenticated and non empty sessions which is likely
worse and less manageable result. Although Vary: Cookie has limitless
potential to diminish the effectiveness of caching since the cookie can be
unique for so many reasons beyond Django's use of sessions/cookies. It
seems a better approach would be to do some normalization at the cache
layer or maybe https://github.com/rory/django-dont-vary-on. I have decided
to close this ticket and provided my patch for completeness or anything it
might offer to ticket #29471.
--
Ticket URL: <https://code.djangoproject.com/ticket/29971#comment:4>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/070.835f667dbe502cd203f62fb07c33a5fa%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
