[Django] #37280: ContentSecurityPolicyMiddleware should set Cache-Control: Private if a nonce is rendered

[Django]

#37280: ContentSecurityPolicyMiddleware should set Cache-Control: Private if a
nonce is rendered
-------------------------------------+-------------------------------------
Reporter: Jacob | Owner: Django Sprints
Walls |
Type: | Status: assigned
Cleanup/optimization |
Component: Core | Version: dev
(Cache system) |
Severity: Normal | Keywords: csp nonce
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
If a CSP nonce is rendered into a response, the response is no longer
suitable for caching. See discussion
[https://github.com/mdn/content/issues/44021#issuecomment-5210572814 at
MDN issue tracker] and [https://docs.djangoproject.com/en/dev/ref/csp
/#nonce-generation-and-caching our docs]:

> Avoid caching full responses that include {{ csp_nonce }} or
csp_nonce_attr.

We can make it easier for pages cached with the `UpdateCacheMiddleware` to
do the secure thing by default by having the
`ContentSecurityPolicyMiddleware` set `Cache-Control: Private` ''if'' a
nonce has been rendered.

Then, for this case:

> If caching is necessary, use a strategy that injects a fresh nonce on
each request

Johannes mused about an opt-out mechanism for folks who have done exactly
that -- injected a fresh nonce somehow -- e.g. with a class attribute on
the middleware to keep the Django 6.0 status quo.

----
Then, for the per-page cache, It's a known flaw that `@cache_page` runs
before middlewares have had a chance to set interesting headers (#15855).
So the above won't help. We could simply mention CSP nonces in the same
paragraph added in 4ef959ab0c7dde0459041a795359c9bc040df2b7, unless we
think it's redundant.
--
Ticket URL: <https://code.djangoproject.com/ticket/37280>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#37280: ContentSecurityPolicyMiddleware should set Cache-Control: Private if a
nonce is rendered
-------------------------------------+-------------------------------------

Reporter: Jacob Walls | Owner: Django
| Sprints
Type: New feature | Status: assigned
Component: Core (Cache system) | Version: dev
Severity: Normal | Resolution:

Keywords: csp nonce | Triage Stage:

| Unreviewed
Has patch: 0 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Jacob Walls):

* type: Cleanup/optimization => New feature

Comment:

Worth a release note
--
Ticket URL: <https://code.djangoproject.com/ticket/37280#comment:1>

[Django]

#37280: ContentSecurityPolicyMiddleware should set Cache-Control: Private if a
nonce is rendered
-------------------------------------+-------------------------------------
Reporter: Jacob Walls | Owner: Django
| Sprints
Type: New feature | Status: assigned
Component: Core (Cache system) | Version: dev
Severity: Normal | Resolution:

Keywords: csp nonce | Triage Stage: Accepted

Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by David Smith):

* stage: Unreviewed => Accepted

--
Ticket URL: <https://code.djangoproject.com/ticket/37280#comment:2>

[Django]

#37280: ContentSecurityPolicyMiddleware should set Cache-Control: Private if a
nonce is rendered
-------------------------------------+-------------------------------------

Reporter: Jacob Walls | Owner: Shubham
| Akhilesh Singh

Type: New feature | Status: assigned
Component: Core (Cache system) | Version: dev
Severity: Normal | Resolution:
Keywords: csp nonce | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Shubham Akhilesh Singh):

* owner: Django Sprints => Shubham Akhilesh Singh

--
Ticket URL: <https://code.djangoproject.com/ticket/37280#comment:3>

[Django]

#37280: ContentSecurityPolicyMiddleware should set Cache-Control: Private if a
nonce is rendered
-------------------------------------+-------------------------------------
Reporter: Jacob Walls | Owner: Shubham
| Akhilesh Singh
Type: New feature | Status: assigned
Component: Core (Cache system) | Version: dev
Severity: Normal | Resolution:
Keywords: csp nonce | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Shubham Akhilesh Singh):

* has_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/37280#comment:4>

[Django]

#37280: ContentSecurityPolicyMiddleware should set Cache-Control: Private if a
nonce is rendered
-------------------------------------+-------------------------------------
Reporter: Jacob Walls | Owner: Shubham
| Akhilesh Singh
Type: New feature | Status: assigned
Component: Core (Cache system) | Version: dev
Severity: Normal | Resolution:
Keywords: csp nonce | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by blighj):

* needs_better_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/37280#comment:5>