Repository navigation
Conversation
Part 1 of #979. The /v1/ cacheability work in part 2 is not in this change, so this deliberately does not close the issue. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Part 2 of #979. v1 responses carried no Cache-Control, so Cloudflare treated these extensionless paths as dynamic and nothing was cached. Without this the part 1 redirect turns ~1.43M free 404s into ~1.43M database-backed v1 calls. Caching the 301s as well means the edge answers them and the origin stops seeing that traffic, which is the benefit the dropped Cloudflare redirect rule would have provided, kept in version control instead. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Two bugs in the previous commit, both found by code review. CacheControlMiddleware was last in MIDDLEWARE, so its response phase ran before CsrfViewMiddleware and SessionMiddleware had set their cookies, making the response.cookies and Vary: Cookie guards dead code. The browsable API was returning Cache-Control: public alongside Set-Cookie: csrftoken, which would have put one CSRF token in a shared cache for every viewer. Moved it first so its response phase runs last. It also cached the browsable API's HTML. Cloudflare ignores Vary, so an edge copy of that HTML could be served to JSON clients for up to s-maxage. Now only application/json responses are cached. The legacy 301s still are: their Location does not vary by Accept. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Clears two CodeQL alerts (py/insecure-cookie, py/client-exposed-cookie). The cookie is set on a throwaway response inside a unit test and never reaches a client, but the guard only checks whether any cookie is present, so flagging it the way a real session cookie would be costs nothing and avoids a suppression. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
bugfix: redirect legacy unversioned /monsters/ and /spells/ to /v1/, and make /v1/ cacheable
Removed problematic 'subclass_of': ['exact'] as it was leading to n+1 query + created a django filter that returns a query set with related foreign key objected loaded.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated patch release v2.2.2 from staging.
Merge with Create a merge commit. Do not squash or rebase — the finalize workflow checks for a real merge commit before marking the release as latest.
The GitHub release is a prerelease until this PR is merged. After merge, this stops being a prerelease and main is merged back into staging.