Re: [Django] #13894: Provide caching guidance for messages framework (was: Disable upstream caching with messages framework)

[Django]

#13894: Provide caching guidance for messages framework
--------------------------------------+------------------------------------
Reporter: Torsten Bronger | Owner: nobody
Type: Cleanup/optimization | Status: new
Component: Documentation | Version: 1.2
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------------+------------------------------------
Changes (by Jacob Walls):

* cc: Sarah Boyce (added)
* component: contrib.messages => Documentation
* resolution: wontfix =>
* stage: Design decision needed => Accepted
* status: closed => new
* summary: Disable upstream caching with messages framework => Provide
caching guidance for messages framework
* type: Bug => Cleanup/optimization

Comment:

The Security Team just closed a report extrapolating from CVE-2026-35192,
suggesting `patch_vary_headers(response, ("Cookie",))` was missing from
the messages middleware. We closed it on the basis that caching pages with
messages is problematic, and Django should refuse to guess what the
correct behavior is. Still, we could provide some guidance in the docs to
prevent mistakes.

I believe Sarah also plans to open a Forum thread to consider if we need
any code changes here as well, but Accepting on the assumption we at least
want a docs update.
--
Ticket URL: <https://code.djangoproject.com/ticket/13894#comment:6>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.