Skip to content

Re-enable anonymous page caching with proper cache invalidation#960

Open
sdeibel wants to merge 1 commit into
ASKBOT:masterfrom
sdeibel:pr/03-anonymous-caching
Open

Re-enable anonymous page caching with proper cache invalidation#960
sdeibel wants to merge 1 commit into
ASKBOT:masterfrom
sdeibel:pr/03-anonymous-caching

Conversation

@sdeibel

@sdeibel sdeibel commented Apr 9, 2026

Copy link
Copy Markdown

The question detail page had caching disabled with a TODO comment ("temporary, until invalidation fix"). This restores caching for anonymous users by:

  • Setting is_cacheable back to the computed value in the question view
  • Adding invalidate_cached_thread_content_html() to the Thread model, which clears the template fragment cache for the question detail page
  • Calling it from clear_cached_data() so all cache invalidation paths (new answers, edits, comments, etc.) also clear the page cache
  • Adding cache invalidation in publish_post() for post privacy toggles
  • Wiring UpdateCacheMiddleware (first) and FetchFromCacheMiddleware (last) in the settings template MIDDLEWARE
  • Adding CACHE_MIDDLEWARE_ALIAS setting

The question detail page had caching disabled with a TODO comment
("temporary, until invalidation fix"). This restores caching for
anonymous users by:

- Setting is_cacheable back to the computed value in the question view
- Adding invalidate_cached_thread_content_html() to the Thread model,
  which clears the template fragment cache for the question detail page
- Calling it from clear_cached_data() so all cache invalidation paths
  (new answers, edits, comments, etc.) also clear the page cache
- Adding cache invalidation in publish_post() for post privacy toggles
- Wiring UpdateCacheMiddleware (first) and FetchFromCacheMiddleware
  (last) in the settings template MIDDLEWARE
- Adding CACHE_MIDDLEWARE_ALIAS setting
@evgenyfadeev

Copy link
Copy Markdown
Member

I think it's possible that this one caused the leakage of the CSRF token. The caching of this page is tricky because it has personalized content - such the CSRF token and some markup variants, depending on the user type.

@sdeibel

sdeibel commented May 22, 2026

Copy link
Copy Markdown
Author

Possibly, although I didn't run into the bug until recently so not sure if there was also a compounding issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants