The site is cached in corporate networks

Question

Django

Hello.

There is a corporate Django application with authorization. From time to time, people from large organizations (telecoms, banks) call and complain that they see pages with information about another user, for example, their colleague. I suspect that this is due to caching on proxy servers in these organizations: it is possible that the proxy gives the cookies of the authorized user to everyone indiscriminately, as a result of which the anonymous user who receives them logs in automatically.

The question is how to avoid this? Added to the template:
<meta http-equiv="Cache-Control" content="no-cache">
but does not help. Maybe you need to give the cache control as a header?

Janga 1.4, Python 2.7, Apache 2.2, mod_wsgi, session is stored in cookies.

UPD: made a middvar:

#nevercache.py
from django.utils.cache import patch_cache_control

class NeverCacheMiddleware():
    def process_response(self, request, response):
        patch_cache_control(response, no_cache=True, no_store=True,
                                must_revalidate=True, proxy_revalidate=True)
        return response

#settings.py
MIDDLEWARE_CLASSES = (
    "nevercache.NeverCacheMiddleware",
    #...
)

Answer 1

It's in the form of a header. Caching is affected by the Cache-Control and Expires headers. In Django, headers are available as keys of the HttpResponse class object:

response = HttpResponse()
response['Cache-Control'] = 'no-cache'
response['Expires'] = 'Mon, 26 Jul 1997 05:00:00 GMT'

Answer 2

And bind it to the global layout?
For example, for me, all the markup of all pages is stored in one file, the text of the pages is already twitching separately.
But I have Asp.Net MVC.

Answer 3

It is necessary to disable page caching if the user is logged in.