On 01/07/2017 03:25 AM, Florian Apolloner wrote: > On Saturday, January 7, 2017 at 3:50:56 AM UTC+1, Jeff Willette wrote: > > What if there was an optional middleware early in the request > processing that matched cookies based on a regex in settings and > then modified the header to only include the matched cookies? > > > I do not see how this would help -- you'd still have to set "Vary: > Cookie" on the response as soon as you are accessing request.user. Or is > the goal of this to allow Django's internal page caching stuff to ignore > some cookies? That seems doable, but very very dangerous.
Right, the latter is how I understood it; you'd still use Vary: Cookie, but strip some cookies before the request reaches the cache middleware. I don't think it's too dangerous, if you're conservative about the cookies you strip (e.g. only strip cookies that are known for sure to be unused on the server, like Google Analytics cookies for instance.) > > This issue reminds me of another issue I came up with (or as Carl puts > it: "…presenting the hypothetical case that exposed this bug."), namely > https://code.djangoproject.com/ticket/19649 -- Basically as soon as > Django accesses __any__ cookie we should set "Vary: Cookie", with all > the downsides this entails. I think we finally should fix that and put a > fix for it into the BaseHandler. +1 > What would be great would be an HTTP header which allowed for something > ala "Cache: if-request-did-not-have-cookies" -- usually it is pointless > to cache __anything__ with cookies anyways. That said, with all the > analytics super cookies out there, there are not many pages without > cookies anymore :( +1. Basically analytics have already effectively broken HTTP caching as it was designed to work. Carl -- You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-developers+unsubscr...@googlegroups.com. To post to this group, send email to django-developers@googlegroups.com. Visit this group at https://groups.google.com/group/django-developers. To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/709febeb-8336-aafa-7faa-74d1e2b46802%40oddbird.net. For more options, visit https://groups.google.com/d/optout.
signature.asc
Description: OpenPGP digital signature
