#13894: Provide caching guidance for messages framework
--------------------------------------+------------------------------------
Reporter: Torsten Bronger | Owner: nobody
Type: Cleanup/optimization | Status: new
Component: Documentation | Version: 1.2
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------------+------------------------------------
Changes (by Jacob Walls):
* cc: Sarah Boyce (added)
* component: contrib.messages => Documentation
* resolution: wontfix =>
* stage: Design decision needed => Accepted
* status: closed => new
* summary: Disable upstream caching with messages framework => Provide
caching guidance for messages framework
* type: Bug => Cleanup/optimization
Comment:
The Security Team just closed a report extrapolating from CVE-2026-35192,
suggesting `patch_vary_headers(response, ("Cookie",))` was missing from
the messages middleware. We closed it on the basis that caching pages with
messages is problematic, and Django should refuse to guess what the
correct behavior is. Still, we could provide some guidance in the docs to
prevent mistakes.
I believe Sarah also plans to open a Forum thread to consider if we need
any code changes here as well, but Accepting on the assumption we at least
want a docs update.
--
Ticket URL: <https://code.djangoproject.com/ticket/13894#comment:6>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/django-updates/0107019e89447164-856a41bb-9f64-4de9-8eda-6dfda3c39ab3-000000%40eu-central-1.amazonses.com.
