Web cache deception vulnerabilities with Cloudflare and Django

If you’re using Django (or any standards-compliant web application using cookie-based sessions) behind Cloudflare, you need to be aware of a massive limitation in their cache implementation that could lead to caching and leakage of private responses (intended for a specific user presenting their session cookie) to everyone . Background: the Vary header # The Vary response header is used by an…