Pages are cached while the request policy was set to deny

Quoting #4:

I never committed #3 because the failing test-only patch only failed locally, not on d.o 😬

But as of today, 📌 Adopt GitLab CI Active happened, which means it should be easier to reproduce now.

You're right that BigPipe Sessionless does store things it should not store. However, thanks to \Drupal\page_cache\StackMiddleware\PageCache::handle(), any Page Cache request policy still is applied:

  public function handle(Request $request, $type = self::MAIN_REQUEST, $catch = TRUE): Response {
    // Only allow page caching on master request.
    if ($type === static::MAIN_REQUEST && $this->requestPolicy->check($request) === RequestPolicyInterface::ALLOW) {
      $response = $this->lookup($request, $type, $catch);
    }
    else {
      $response = $this->pass($request, $type, $catch);
    }

    return $response;
  }

… that explains why I was not able to reproduce this on DrupalCI. It's odd/weird that I was able to reproduce this locally, but maybe that was PEBKAC? 🤔

(And that's a good thing, because otherwise this would've been a security vulnerability that was immediately publicly disclosed 😅)

So … wrote additional test coverage to actually inspect the cache bin, because that's the only way to detect this: https://git.drupalcode.org/project/big_pipe_sessionless/-/merge_requests....

Looked at it again this morning … let's ship this 😊

Automatically closed - issue fixed for 2 weeks with no activity.