... as severity "low" according to the Django security policy . CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization ¶ UpdateCacheMiddleware and cache_page() decorator allowed responses to requests bearing an Authorization h ... c ) to be cached. To conform with the existing mechanism for constructing cache keys, responses to these requests will now vary on Authorization . This issue has severity "low" according to the Django security policy . CVE-2026-48587: Potential expos ... ure of private data via whitespace padding in Vary header ¶ UpdateCacheMiddleware incorrectly cached responses whose Vary header values contained leading or trailing whitesp ... ... as severity "low" according to the Django security policy . CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization ¶ UpdateCacheMiddleware and cache_page() decorator allowed responses to requests bearing an Authorization h ... c ) to be cached. To conform with the existing mechanism for constructing cache keys, responses to these requests will now vary on Authorization . This issue has severity "low" according to the Django security policy . CVE-2026-48587: Potential expos ... ure of private data via whitespace padding in Vary header ¶ UpdateCacheMiddleware incorrectly cached responses whose Vary header values contained leading or trailing whitesp ... ... as severity "low" according to the Django security policy . CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization ¶ UpdateCacheMiddleware and cache_page() decorator allowed responses to requests bearing an Authorization h ... c ) to be cached. To conform with the existing mechanism for constructing cache keys, responses to these requests will now vary on Authorization . This issue has severity "low" according to the Django security policy . CVE-2026-48587: Potential expos ... ure of private data via whitespace padding in Vary header ¶ UpdateCacheMiddleware incorrectly cached responses whose Vary header values contained leading or trailing whitesp ... ... ware runs cache_page is intended for content that is safe to reuse for requests to the same URL. It does not automatically vary by authentication, sessions, cookies, or other request-specific state. As a decorator wrapping the view directly, response ... . For example, when caching views containing CSRF-protected forms, follow キャッシュによるCSRF保護を利用する to ensure the Vary header is set first. ビューごとのキャッシュを URLconf で指定する ¶ The examples in the previous section have hardcoded the ... ないキャッシュ名を指定することはエラーとみなされます。 django.core.cache.utils. make_template_fragment_key ( fragment_name , vary_on = None ) ¶ If you want to obtain the cache key used for a cached fragment, you can use make_template_fragment_key . fra ... ... ware runs cache_page is intended for content that is safe to reuse for requests to the same URL. It does not automatically vary by authentication, sessions, cookies, or other request-specific state. As a decorator wrapping the view directly, response ... . For example, when caching views containing CSRF-protected forms, follow キャッシュによるCSRF保護を利用する to ensure the Vary header is set first. ビューごとのキャッシュを URLconf で指定する ¶ The examples in the previous section have hardcoded the ... ないキャッシュ名を指定することはエラーとみなされます。 django.core.cache.utils. make_template_fragment_key ( fragment_name , vary_on = None ) ¶ If you want to obtain the cache key used for a cached fragment, you can use make_template_fragment_key . fra ... ... as severity "low" according to the Django security policy . CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization ¶ UpdateCacheMiddleware and cache_page() decorator allowed responses to requests bearing an Authorization h ... c ) to be cached. To conform with the existing mechanism for constructing cache keys, responses to these requests will now vary on Authorization . This issue has severity "low" according to the Django security policy . CVE-2026-48587: Potential expos ... ure of private data via whitespace padding in Vary header ¶ UpdateCacheMiddleware incorrectly cached responses whose Vary header values contained leading or trailing whitesp ... ... を制御します。 gzip_page () ¶ このデコレータは、ブラウザが gzip 圧縮を許可している場合にコンテンツを圧縮します。それに応じて Vary ヘッダを設定し、キャッシュがそのストレージを Accept-Encoding ヘッダに基づいて行うようにします。 Vary ヘッダ ¶ django.views ... .decorators.vary のデコレータを使って、特定のリクエストヘッダに基づいてキャッシュを制御できます。 vary_on_cookie ( func ) ¶ vary_on_headers ... ( * headers ) [ソース] ¶ Vary ヘッダーはキャッシュメカニズムがキャッシュキーを構築するときにどのリクエストヘッダを考慮すべきかを定義します。 詳しくは va ... ... を制御します。 gzip_page () ¶ このデコレータは、ブラウザが gzip 圧縮を許可している場合にコンテンツを圧縮します。それに応じて Vary ヘッダを設定し、キャッシュがそのストレージを Accept-Encoding ヘッダに基づいて行うようにします。 Vary ヘッダ ¶ django.views ... .decorators.vary のデコレータを使って、特定のリクエストヘッダに基づいてキャッシュを制御できます。 vary_on_cookie ( func ) ¶ vary_on_headers ... ( * headers ) [ソース] ¶ Vary ヘッダーはキャッシュメカニズムがキャッシュキーを構築するときにどのリクエストヘッダを考慮すべきかを定義します。 詳しくは va ... ... olicy . CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST ¶ Response headers did not vary on cookies if a session was not modified, but SESSION_SAVE_EVERY_REQUEST was True . A remote attacker could steal a user's ... " according to the Django security policy . CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware ¶ Previously, UpdateCacheMiddleware would erroneously cache requests where the Vary header con ... cached pages and SESSION_SAVE_EVERY_REQUEST CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware 前のトピックへ Django 5.2.15 release notes 次のトピックへ Django 5.2.13 release notes 関連キー ... ... olicy . CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST ¶ Response headers did not vary on cookies if a session was not modified, but SESSION_SAVE_EVERY_REQUEST was True . A remote attacker could steal a user's ... " according to the Django security policy . CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware ¶ Previously, UpdateCacheMiddleware would erroneously cache requests where the Vary header con ... cached pages and SESSION_SAVE_EVERY_REQUEST CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware 前のトピックへ Django 5.2.15 release notes 次のトピックへ Django 5.2.13 release notes 関連キー ... 2026年10月08日