process_response marks the session accessed, so every response gets Vary: Cookie

[Mawox]

Quart.process_response reads the session through the ctx.session property:

session_ = ctx.session
if not self.session_interface.is_null_session(session_):
    await self.ensure_async(self.session_interface.save_session)(
        self, session_, response
    )

That property sets session.accessed = True, so SecureCookieSessionInterface.save_session then adds Vary: Cookie to every response. This includes views that never touch the session, and static files. As a result, no shared cache or CDN will store them.

Minimal reproduction (Quart 0.23.1, also current main):

import asyncio

from quart import Quart

app = Quart(__name__)
app.secret_key = "not-secret"


@app.get("/")
async def index() -> str:
    return "this view never touches the session"


async def main() -> None:
    response = await app.test_client().get("/")
    print("Vary:", response.headers.get("Vary"))


asyncio.run(main())

Output: Vary: Cookie. The equivalent Flask 3.1.3 app prints Vary: None, because Flask's process_response reads the private attribute instead:

if not self.session_interface.is_null_session(ctx._session):
    self.session_interface.save_session(self, ctx._session, response)

Proposed fix: do the same in Quart.process_response (and in the websocket counterpart, which has the same session_ = ctx.session line), so only a request that actually used the session varies on the cookie. I'm happy to open a PR.