Merge lp:~mhall119/developer-ubuntu-com/cache-cooke-fix into lp:developer-ubuntu-com

[Michael Hall]

changes the cache-friendly middleware to only strip out session cookies when the user is not logged in *and* when it's a 200 status code.

In order to facilitate caching in China, we strip out session cookies for not logged in requests. However, in situations where there is a 404, 500, or other non-success status code, the Django response does not include the logged in user object, which would cause those logged in user to have their session cookie removed, effectively logging them out.

This changes the cache-friendly middleware to only strip out session cookies when the user is not logged in *and* when it's a 200 status code.

[Nicholas Skaggs (nskaggs)]

+1, this will ensure we only change the response on non-200 status pages. Regarding other codes:

<balloons> mhall119, what about other codes.. so we be explicit instead of implicit? I'm curious about redirects for instance
<mhall119> redirects didn't seem to be a problem
<mhall119> but there's no real reason to share cached responses other than 200
<mhall119> and as far as I know, those are always guaranteed to have a user object associated with them when the user is logged in

review: Approve

=== modified file 'developer_portal/middleware.py'
--- developer_portal/middleware.py	2014-12-19 18:34:54 +0000
+++ developer_portal/middleware.py	2015-05-18 18:24:29 +0000
@@ -15,6 +15,10 @@
     def process_response(self, request, response):
         response = super(CacheFriendlySessionMiddleware, self).process_response(request, response)
 
+        #Don't do anything if it's a redirect, not found, or error
+        if response.status_code != 200:
+            return response
+            
         #You have access to request.user in this method
         if not hasattr(request, 'user') or not request.user.is_authenticated():
             response.delete_cookie(settings.SESSION_COOKIE_NAME)