Clarification RFC 7234 caches for present nonce-sources

[codingjoe]

Hi there 👋,

Greetings from the Django community. I am raising an issue that came up in the Django 6.1 development process and has been raised here:
mdn/content#44021
https://forum.djangoproject.com/t/should-we-make-it-harder-to-cache-responses-containing-csp-nonces/45065

It concerns 7.1 nonce reuse.
I would like to gain clarity on the cache implementation of cache proxies (CDNs).

My understanding is RFC 7234 caches like CDNs should NOT cache responses if a nonce-sources is present in the policy or regenerate them (which nginx and others can do already). Meaning they would NOT require additional instructions via cache-control headers.

If that is not the case, applications would need to set explicit cache-control headers (like "private") to achieve a correct caching behavior.

In both cases, this would require updates to Django's cache middleware or CSP middleware. So your input is greatly appreciated!

Best,
Joe

[codingjoe]

Note that the Set-Cookie response header field [RFC6265] does not inhibit caching; a cacheable response with a Set-Cookie header field can be (and often is) used to satisfy subsequent requests to caches. Servers who wish to control caching of these responses are encouraged to emit appropriate Cache-Control response header fields.

— RFC 7234 8. Security Considerations

The only reference I could find in RFC 7234 is concerning Set-Cookie. This would counter my argument and argue for explicit Cache-Control headers.

---

However! Is full-page caching even vulnerable?

Thought experiment: If the body of the response doesn't change, there is no room to inject malicious scripts. This would be further fortified by e-tags.

Maybe a new nonce must only be created when a new response body is created and NOT when the policy is transmitted.