python - Django missing Vary:Cookie header for cached views -
i've got pretty complex webapp based on django 1.11. time ago users started reporting getting 'someone else's views' - memcached provided them html cached decorator @cache_page(xx) without distinguishing between sessions within cache grace period.
upon further investigation, discovered in cases vary: cookie header missing , wrong 'session' served. what's strange, showed when querying backend curl (which has no session, user etc -> backend served logged in cached view).
unfortunately, issue hard reproduce, occures, doesn't. build simple django app scratch see if check cause. observed, issue not occur when @cache_page removed or login_required added .
i ended removing @cache_page decorators views , issue not observed on production since it's workaround , know cause.
if has hint cause, appreciated!
you're running open bug:
since view decorators run on outgoing response first, before response middleware,
cache_pagedecorator caches response before of mentioned response middlewares have chance add vary headers. means 2 things: 1) cache key used won't include headers response ought vary on, , django may later serve response users shouldn't it, , 2) when cached response later served user, still won't includevaryheader should have, , may cached wrongly upstream http cache.
in other words, @ time response cached sessionmiddleware hasn't yet had chance set vary: cookie header, sessions share same cache key.
you can work around specifying vary header explicitly. example:
from django.views.decorators.cache import cache_page django.views.decorators.vary import vary_on_cookie @cache_page() @vary_on_cookie() def my_view(): pass
Comments
Post a Comment