remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-09-28 21:04:08 +02:00
Code Issues Projects Releases Packages Wiki Activity

Protect personalized dynamic responses from shared caching

Browse source
This commit is contained in:
Simon Willison 2026-09-08 21:16:36 -07:00
commit ceef351622
4 changed files with 55 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

11
tests/test_stored_queries.py
View file

@ -208,11 +208,12 @@ def test_custom_params(stored_write_client):
)
def test_stored_query_pages_no_vary_header(stored_write_client):
# These pages no longer embed per-cookie CSRF tokens, so they must not
# set Vary: Cookie - they should be cacheable across users.
assert "vary" not in stored_write_client.get("/data").headers
assert "vary" not in stored_write_client.get("/data/update_name").headers
def test_stored_query_pages_vary_by_credentials(stored_write_client):
# Even without per-cookie CSRF tokens, anonymous pages must not be reused
# for authenticated users whose permissions or navigation can differ.
for path in ("/data", "/data/update_name"):
response = stored_write_client.get(path)
assert response.headers["vary"] == "Cookie, Authorization"
def test_json_post_body(stored_write_client):