Renforcez la sécurité de vos projets Django avec un « Cache-Control » approprié sur les vues

<code class="language-python">from django.views.decorators.cache import never_cache

@never_cache
def my_secure_view(request):
    # Secure view logic here
    return HttpResponse("This page is protected from caching!")</code>

<code class="language-python"># myproject/views.py

from django.contrib.auth.mixins import LoginRequiredMixin
from django.utils.decorators import method_decorator
from django.views.decorators.cache import never_cache

@method_decorator(never_cache, name="dispatch")
class PrivateAreaMixin(LoginRequiredMixin):
    """Extends LoginRequiredMixin with Cache-Control directives."""</code>

<code class="language-python"># myapp/views.py

from django.views.generic import TemplateView
from myproject.views import PrivateAreaMixin

class IndexView(PrivateAreaMixin, TemplateView):
    """Example index view."""
    template_name = "index.html"</code>

<code class="language-python"># myproject/tests/test_views.py

from django.test import TestCase, RequestFactory
from django.contrib.auth.models import AnonymousUser
from django.contrib.auth import get_user_model
from django.http import HttpResponse
from django.views import View
from myproject.views import PrivateAreaMixin

class PrivateAreaMixinTest(TestCase):
    """Tests the PrivateAreaMixin's Cache-Control implementation."""

    factory = RequestFactory()

    @classmethod
    def setUpTestData(cls):
        cls.user = get_user_model().objects.create_user(
            username="testuser",
            email="user@test.xyz",
            password="5tr0ngP4ssW0rd",
        )

    def test_login_required_with_cache_control(self):
        class AView(PrivateAreaMixin, View):
            def get(self, request, *args, **kwargs):
                return HttpResponse()

        view = AView.as_view()

        # Test redirection for unauthenticated users
        request = self.factory.get("/")
        request.user = AnonymousUser()
        response = view(request)
        self.assertEqual(response.status_code, 302)
        self.assertEqual("/accounts/login/?next=/", response.url)

        # Test authenticated user and Cache-Control headers
        request = self.factory.get("/")
        request.user = self.user
        response = view(request)
        self.assertEqual(response.status_code, 200)
        self.assertIn("Cache-Control", response.headers)
        self.assertEqual(
            response.headers["Cache-Control"],
            "max-age=0, no-cache, no-store, must-revalidate, private",
        )</code>