The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.The core page cache, if enabled, caches the access denied page for protected downloads at system/files/private/foo.bar if/when an anonymous does not have access (expired or already-used download link)
Then, later anonymous users will receive this access denied page when attempting to download the file, even if they have a session which should grant them access.
Solution is for wpd to disable the page cache for files it protects.
| Comment | File | Size | Author |
|---|---|---|---|
| wpd-cache.patch | 837 bytes | mfb |
Comments
Comment #1
berliner commentedThis makes sense. I wasn't aware that files routed through system/files are cached too.
Since drupals page cache is url based, we certainly don't want the downloads page to be cached as neither. So I added this to the function webform_protected_downloads_download_page() as well.