Repository navigation
Avoid caching responses for authenticated users - #67110
Merged
Merged
Conversation
If auth middleware was after the output caching middleware and some other auth was used besides the authorization header, then apps could end up caching a page meant for a specific user and then serve the cached page for anonymous or other users.
github-actions
Bot
added
the
area-middleware
BrennanConroy
approved these changes
Jun 10, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the OutputCaching default behavior to ensure responses generated for authenticated users are not stored in the output cache, including scenarios where authentication happens after the output cache middleware in the pipeline.
Changes:
- Update
DefaultPolicyto disable cache storage when the response is produced under an authenticatedHttpContext.User. - Add tests verifying authenticated requests are not cached regardless of whether auth middleware runs before/after output caching.
- Add a negative test demonstrating that placing auth middleware after output caching can result in auth not running on cache hits.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| src/Middleware/OutputCaching/test/OutputCacheTests.cs | Adds coverage for “authenticated responses are not cached” and a negative ordering test for auth-after-cache behavior. |
| src/Middleware/OutputCaching/src/Policies/DefaultPolicy.cs | Prevents cache storage for responses when the request ends up authenticated. |
Comment on lines
+53
to
+57
| if (context.HttpContext.User?.Identity?.IsAuthenticated == true) | ||
| { | ||
| context.AllowCacheStorage = false; | ||
| return ValueTask.CompletedTask; | ||
| } |
Comment on lines
+1049
to
+1053
| { | ||
| services.AddOutputCache(outputCachingOptions => | ||
| { | ||
| outputCachingOptions.BasePolicies = [new OutputCachePolicyBuilder().Build()]; | ||
| }); |
Comment on lines
+1148
to
+1153
| .ConfigureServices(services => | ||
| { | ||
| services.AddOutputCache(outputCachingOptions => | ||
| { | ||
| outputCachingOptions.BasePolicies = [new OutputCachePolicyBuilder().Build()]; | ||
| }); |
Member
Author
|
/ba-g unrelated mac failure |
This was referenced Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.