python - Django missing Vary:Cookie header for cached views -


i've got pretty complex webapp based on django 1.11. time ago users started reporting getting 'someone else's views' - memcached provided them html cached decorator @cache_page(xx) without distinguishing between sessions within cache grace period.

upon further investigation, discovered in cases vary: cookie header missing , wrong 'session' served. what's strange, showed when querying backend curl (which has no session, user etc -> backend served logged in cached view).

unfortunately, issue hard reproduce, occures, doesn't. build simple django app scratch see if check cause. observed, issue not occur when @cache_page removed or login_required added .

i ended removing @cache_page decorators views , issue not observed on production since it's workaround , know cause.

if has hint cause, appreciated!

you're running open bug:

since view decorators run on outgoing response first, before response middleware, cache_page decorator caches response before of mentioned response middlewares have chance add vary headers. means 2 things: 1) cache key used won't include headers response ought vary on, , django may later serve response users shouldn't it, , 2) when cached response later served user, still won't include vary header should have, , may cached wrongly upstream http cache.

in other words, @ time response cached sessionmiddleware hasn't yet had chance set vary: cookie header, sessions share same cache key.

you can work around specifying vary header explicitly. example:

from django.views.decorators.cache import cache_page django.views.decorators.vary import vary_on_cookie  @cache_page() @vary_on_cookie() def my_view():     pass 

Comments

Popular posts from this blog

python - Operations inside variables -

Generic Map Parameter java -

arrays - What causes a java.lang.ArrayIndexOutOfBoundsException and how do I prevent it? -