Problem
A browser app that sends Authorization on every request (a common SPA setup) gets a 0% hit rate on @cache routes, including public ones. Since #296 such requests bypass the backend unless the route sets public=True or cache_authorized=True, and each bypass is logged only at DEBUG:
GET /products (Authorization: Bearer ...) x3 -> handler ran 3 times, Cache-Control: private, max-age=60
The behaviour is safe. The problem is that a new user sees no caching and nothing tells them why. public=True is the escape hatch, but it also changes the Cache-Control sent downstream, which is not obvious from its name.
Proposal
- Log once per route at
INFO (or WARNING) the first time an Authorization request bypasses it, naming the two options.
- Explain in HTTP_CACHING.md which option to choose for "the response is the same for every user" versus "the response is per user".
Problem
A browser app that sends
Authorizationon every request (a common SPA setup) gets a 0% hit rate on@cacheroutes, including public ones. Since #296 such requests bypass the backend unless the route setspublic=Trueorcache_authorized=True, and each bypass is logged only atDEBUG:The behaviour is safe. The problem is that a new user sees no caching and nothing tells them why.
public=Trueis the escape hatch, but it also changes theCache-Controlsent downstream, which is not obvious from its name.Proposal
INFO(orWARNING) the first time anAuthorizationrequest bypasses it, naming the two options.