Strip Set-Cookie header on public endpoints (#1775)

Author: mkst

backend/coreapp/middleware.py

@@ -159,3 +159,15 @@ def middleware(request: Request) -> Response:
         return response
 
     return middleware
+
+
+def strip_session(
+    get_response: Callable[[HttpRequest], Response],
+) -> Callable[[Request], Response]:
+    def middleware(request: Request) -> Response:
+        response = get_response(request)
+        if is_public_request(request):
+            response.cookies.clear()
+        return response
+
+    return middleware

backend/decompme/settings.py

@@ -82,6 +82,7 @@
 ]
 
 MIDDLEWARE = [
+    "coreapp.middleware.strip_session",
     "coreapp.middleware.strip_cookie_vary",
     "django.middleware.security.SecurityMiddleware",
     "django.contrib.sessions.middleware.SessionMiddleware",