Vary: Cookie is no longer emitted — Flask 3.1.3 session-vary behavior not replicated for FastAPI

Open Beginner friendly
#6,093 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python

Research direction

Start in src/local_deep_research/web/fastapi_app.py and inspect the security-header and session middleware paths that produce authenticated responses. Compare the current behavior with the issue’s Flask session-Vary background, then verify that authenticated-session responses emit Vary: Cookie while the existing non-static cache behavior remains intact.

Written by the indexing model from the issue text.

Description

Background

Old main pinned flask~=3.1.3 specifically for the CVE-2026-27205 fix ("session Vary: Cookie header"): responses that depend on the session cookie were automatically marked Vary: Cookie so shared caches cannot serve one user's session-dependent response to another.

Current state

No Vary handling exists anywhere in the FastAPI middleware stack (src/local_deep_research/web/fastapi_app.py — security-header and session middlewares). Mitigation: non-static responses do send Cache-Control: no-store, which compliant caches honor, so exposure is limited to non-compliant or configured-to-override caches that could reuse a session-dependent response across users.

Direction

Add Vary: Cookie to responses produced under an authenticated session in the security-header middleware — cheap belt-and-braces parity with the Flask-era behavior we deliberately pinned a CVE fix release for.

Dominant language
Python
Stars
9.1k
Forks
824
Avg merge
3d 4h
Merged PRs (30d)
289

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from LearningCircuit/local-deep-research

All issues in LearningCircuit/local-deep-research

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.