1910092 - Add Vary: Auth-Token header in APITokenAuthenticationMiddleware

Status: RESOLVED FIXED

(Tecken :: General, task, P2)

Description

[Sven Marnach :sven]

We are currently setting "Cache-Control: no-store" in nginx, which essentially prevents all caching. In GCP we will no longer add the Cache-Control header in nginx. To make any potential client-side caching of Tecken's responses to auth-token authenticated requests behave correctly, we should set "Vary: Auth-Token" on all responses to requests that include an auth token.

Comment 1

[Sven Marnach :sven]

Attachment: [mozilla-services/tecken] bug-1910092: Add Vary: Auth-Token header for requests with a token. (#3006)

Comment 2

[Sven Marnach :sven]

smarnach merged PR [mozilla-services/tecken]: bug-1910092: Add Vary: Auth-Token header for requests with a token. (#3006) in 89a81f5.

Comment 3

[Sven Marnach :sven]

This was deployed to production with the tag v2024.09.12. When testing this in production, the response contains two Vary headers:

Vary: Accept-Encoding
Vary: Auth-Token

It looks like the first one is added by nginx, possibly for the gzip encoding (though I wasn't able to reproduce the behaviour locally). I think it's fine to have two Vary headers, so I'll call this fixed.