xsrf_form_html: Set Vary: Cookie header

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/web/base.py b/src/web/base.py
index 96df315e4d8bb64b267f29ed9309ee8a9ddcdff7..b6fee9b5f68ef44c59c4933462902edf4bee9fb0 100644 (file)
--- a/src/web/base.py
+++ b/src/web/base.py
@@ -30,6 +30,12 @@ class BaseHandler(tornado.web.RequestHandler):
 
                self.render("error.html", status_code=status_code, message=message, **kwargs)
 
+       def xsrf_form_html(self, *args, **kwargs):
+               # Set Vary: Cookie header
+               self.add_header("Vary", "Cookie")
+
+               return super().xsrf_form_html(*args, **kwargs)
+
        @property
        def hostname(self):
                # Remove the development prefix