archweb
archweb copied to clipboard
Cache the mirrorstatus json without potentially leaking secrets
The mirror status json endpoint behaves different if an authenticated user or normal user query it, making caching it return either the wrong data or sensitive data.
https://github.com/archlinux/archweb/commit/205ebb8f40982fe0c7b5b37af32b813ccaa012d2
Seems the django cache framework does not have an easy way to cache depending on the authenticated header, I've only found this decorator. As the main /mirrors/status/json feed is cached by nginx this issue's priority is low.