Fixed #28833 -- Prevented CacheMiddleware from caching responses with "Cache-Control: private".

1 files changed, 4 insertions, 0 deletions

diff --git a/django/middleware/cache.py b/django/middleware/cache.py
index 8af0c9db7c..6b320f1db5 100644
--- a/django/middleware/cache.py
+++ b/django/middleware/cache.py
@@ -85,6 +85,10 @@ class UpdateCacheMiddleware(MiddlewareMixin):
         if not request.COOKIES and response.cookies and has_vary_header(response, 'Cookie'):
             return response
 
+        # Don't cache a response with 'Cache-Control: private'
+        if 'private' in response.get('Cache-Control', ()):
+            return response
+
         # Try to get the timeout from the "max-age" section of the "Cache-
         # Control" header before reverting to using the default cache_timeout
         # length.