Use cache-control headers on pages requiring authentication

Issue Summary

When a Page is password protected, its publicly-viewable version displays a password form at the Page’s URL. If caching is used, this means that the form itself can get cached, preventing the user from progressing to the Page itself - the cached password form can keep getting returned.

I and @vsalvino had this issue using wagtail-cache, which he provided a solution for. But he suggested that if Wagtail itself issued cache-control: private headers when the page required authentication, that would probably make more sense.

Steps to Reproduce

1. Install wagtail-cache (or maybe use some other caching solution)
2. Create a Page, set it to Live, and protect it with a Password
3. Visit the Page’s URL and enter the correct password
4. Instead of getting the Page itself, the form will be returned.

Technical details

• Python version: 3.6
• Django version: 2.1
• Wagtail version: 2.4
• Browser version: macOS Safari 12

Looks like there was a similar proposal in 2015, closed due to lack of interest. @loicteixeira in Slack suggested I open this.

[kaedroho]

I was thinking that the Vary: Cookie header that Django automatically emits whenever request.session is accessed would solve this. But this might not be the case if the cookies are being created by this view.

What I think might be happening is follows:

1. When the first user without a cookie visits the page, Django creates session and returns response with Set-Cookie and Vary: Cookie headers

2. When the second user without a cookie visits the page, the cache returns the first user’s response because the first user didn’t have a cookie when they made the request (and Vary: Cookie probably isn’t clever enough to see the Set-Cookie in the response)

If that’s the case, then adding Cache-control: private or just Cache-control no-cache="Set-Cookie" should solve it.

[dragon-dxw]

The lack of Cache-Control headers caused us not only an availability issue (CSRF errors when attempting to log in) but also significant security issues (the password-protected content was visible without logging in due to the cache, once a different browser could log in).

https://github.com/coderedcorp/wagtail-cache/issues/35 details some of our testing (the lack of a “don’t cache” Cache-Control header is a problem for core, it would seem)