From adcf823359d7402fc1f57a2e005cea52905d897d Mon Sep 17 00:00:00 2001 From: Kaleb Elwert Date: Thu, 1 Oct 2015 12:52:18 -0700 Subject: [PATCH] Fixed #25490 -- Made the logout() view send "no-cache" headers. --- django/contrib/auth/views.py | 1 + docs/releases/1.10.txt | 4 ++++ tests/auth_tests/test_views.py | 8 ++++++++ 3 files changed, 13 insertions(+) diff --git a/django/contrib/auth/views.py b/django/contrib/auth/views.py index fc8b37823ce..6362bf1daff 100644 --- a/django/contrib/auth/views.py +++ b/django/contrib/auth/views.py @@ -92,6 +92,7 @@ def login(request, template_name='registration/login.html', @deprecate_current_app +@never_cache def logout(request, next_page=None, template_name='registration/logged_out.html', redirect_field_name=REDIRECT_FIELD_NAME, diff --git a/docs/releases/1.10.txt b/docs/releases/1.10.txt index 66d3828087d..52ba47a2d34 100644 --- a/docs/releases/1.10.txt +++ b/docs/releases/1.10.txt @@ -47,6 +47,10 @@ Minor features subclassed ``django.contrib.auth.hashers.PBKDF2PasswordHasher`` to change the default value. +* The :func:`~django.contrib.auth.views.logout` view sends "no-cache" headers + to prevent an issue where Safari caches redirects and prevents a user from + being able to log out. + :mod:`django.contrib.contenttypes` ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/tests/auth_tests/test_views.py b/tests/auth_tests/test_views.py index 19a47a26979..d7a64608b88 100644 --- a/tests/auth_tests/test_views.py +++ b/tests/auth_tests/test_views.py @@ -770,6 +770,14 @@ class LogoutTest(AuthViewsTestCase): response = self.client.get('/logout/') self.assertIn('site', response.context) + def test_logout_doesnt_cache(self): + """ + The logout() view should send "no-cache" headers for reasons described + in #25490. + """ + response = self.client.get('/logout/') + self.assertIn('no-store', response['Cache-Control']) + def test_logout_with_overridden_redirect_url(self): # Bug 11223 self.login()