Vary: Cookie is no longer emitted — Flask 3.1.3 session-vary behavior not replicated for FastAPI
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- python
- Domain
- authentication, backend, security
Research direction
Start in src/local_deep_research/web/fastapi_app.py and inspect the security-header and session middleware paths that produce authenticated responses. Compare the current behavior with the issue’s Flask session-Vary background, then verify that authenticated-session responses emit Vary: Cookie while the existing non-static cache behavior remains intact.
Written by the indexing model from the issue text.
Description
Background
Old main pinned flask~=3.1.3 specifically for the CVE-2026-27205 fix ("session Vary: Cookie header"): responses that depend on the session cookie were automatically marked Vary: Cookie so shared caches cannot serve one user's session-dependent response to another.
Current state
No Vary handling exists anywhere in the FastAPI middleware stack (src/local_deep_research/web/fastapi_app.py — security-header and session middlewares). Mitigation: non-static responses do send Cache-Control: no-store, which compliant caches honor, so exposure is limited to non-compliant or configured-to-override caches that could reuse a session-dependent response across users.
Direction
Add Vary: Cookie to responses produced under an authenticated session in the security-header middleware — cheap belt-and-braces parity with the Flask-era behavior we deliberately pinned a CVE fix release for.
- Dominant language
- Python
- Stars
- 9.1k
- Forks
- 824
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 289
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from LearningCircuit/local-deep-research
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
LearningCircuit/local-deep-research#6664 · 1 comment ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
All issues in LearningCircuit/local-deep-research
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100