Fixed #36560 -- Prevented UpdateCacheMiddleware from caching responses with Cache-Control 'no-cache' or 'no-store'.

1 files changed, 11 insertions, 2 deletions

diff --git a/django/middleware/cache.py b/django/middleware/cache.py
index 10fff365af..8c42a52b4a 100644
--- a/django/middleware/cache.py
+++ b/django/middleware/cache.py
@@ -100,8 +100,17 @@ class UpdateCacheMiddleware(MiddlewareMixin):
         ):
             return response
 
-        # Don't cache a response with 'Cache-Control: private'
-        if "private" in response.get("Cache-Control", ()):
+        # Don't cache responses when the Cache-Control header is set to
+        # private, no-cache, or no-store.
+        cache_control = response.get("Cache-Control", ())
+        if any(
+            directive in cache_control
+            for directive in (
+                "private",
+                "no-cache",
+                "no-store",
+            )
+        ):
             return response
 
         # Page timeout takes precedence over the "max-age" and the default