ERP5Type.patches.BaseRequest: Do more right after user authentication.

bt5/erp5_core_test/TestTemplateItem/portal_components/test.erp5.testCookieCrumbler.py

@@ -89,6 +89,17 @@ class ERP5CookieCrumblerTests (CookieCrumblerTests):
                          self.credentials)
     self.assertEqual(resp.cookies['__ac']['path'], '/')
 
+  def testCacheHeaderDisabled(self):
+    # Cache header is forcibly set on any authenticated user independently from
+    # CookieCrumbler's presence.
+    _, cc, req, credentials = self._makeSite()
+    cc.cache_header_value = ''
+    req.cookies['__ac'] = credentials
+    req.traverse('/')
+    self.assertEqual(
+        req.response.headers.get('cache-control', ''), 'private')
+
+
 def test_suite():
   return unittest.makeSuite(ERP5CookieCrumblerTests)
 

product/ERP5Type/ZopePatch.py

@@ -51,6 +51,7 @@ from Products.ERP5Type.patches import FSZSQLMethod
 from Products.ERP5Type.patches import ActionInformation
 from Products.ERP5Type.patches import ActionProviderBase
 from Products.ERP5Type.patches import ActionsTool
+from Products.ERP5Type.patches import BaseRequest
 from Products.ERP5Type.patches import CookieCrumbler
 from Products.ERP5Type.patches import PropertySheets
 from Products.ERP5Type.patches import CMFCoreSkinnable

product/ERP5Type/patches/BaseRequest.py

+# -*- coding: utf-8 -*-
+
+from functools import partial
+from ZPublisher.BaseRequest import BaseRequest
+
+def setCacheControlPrivateForAuthenticatedUser(request, user, validated_hook_):
+  # If we are publishing a resource for an authenticated user, forbid shared
+  # caches from storing it.
+  # Historially, this was (for some reason) implemented in CookieCrumbler,
+  # but it does not seem very consistent as it then depends on how the user
+  # was authenticated. This is a more neutral location.
+  if user.getUserName() != 'Anonymous User':
+    request.response.setHeader('Cache-Control', 'private')
+  if validated_hook_ is not None:
+    return validated_hook_(request, user)
+
+orig_BaseRequest_traverse = BaseRequest.traverse
+def BaseRequest_traverse(self, path, response=None, validated_hook=None):
+  return orig_BaseRequest_traverse(
+    self,
+    path=path,
+    response=response,
+    validated_hook=partial(
+      setCacheControlPrivateForAuthenticatedUser,
+      validated_hook_=validated_hook,
+    ),
+  )
+BaseRequest.traverse = BaseRequest_traverse