#chan

views.py.diff

-    return HttpResponse(simplejson.dumps(data), mimetype="application/json")
+
+    # The Django Session middleware helpfully adds 'Cookie' to the Vary header if request.session.accessed is true
+    # Firefox won't cache JSON if the response varies by cookie.
+    # Since we mark Cache-Control: private and max-age:60, the attack vector here is very very small:
+    #   People on the same machine as the victim, who read the cache within 60 seconds
+    # So, let's fake out the session middleware to not send the Vary: Cookie header, just Vary: Accept-Encoding.
+    request.session.accessed = False
+
+    response = HttpResponse(simplejson.dumps(data), mimetype="application/json; charset=utf-8")
+    response['Vary'] = 'Accept-Encoding'
+    return response