Fixed #19705 -- Set proper headers on conditional Not Modified responses.

django/utils/cache.py

@@ -122,14 +122,21 @@ def _precondition_failed(request):
 
 
 def _not_modified(request, response=None):
+    new_response = HttpResponseNotModified()
     if response:
-        # We need to keep the cookies, see ticket #4994.
-        cookies = response.cookies
-        response = HttpResponseNotModified()
-        response.cookies = cookies
-        return response
-    else:
-        return HttpResponseNotModified()
+        # Preserve the headers required by Section 4.1 of RFC 7232, as well as
+        # Last-Modified.
+        for header in ('Cache-Control', 'Content-Location', 'Date', 'ETag', 'Expires', 'Last-Modified', 'Vary'):
+            if header in response:
+                new_response[header] = response[header]
+
+        # Preserve cookies as per the cookie specification: "If a proxy server
+        # receives a response which contains a Set-cookie header, it should
+        # propagate the Set-cookie header to the client, regardless of whether
+        # the response was 304 (Not Modified) or 200 (OK).
+        # https://curl.haxx.se/rfc/cookie_spec.html
+        new_response.cookies = response.cookies
+    return new_response
 
 
 def get_conditional_response(request, etag=None, last_modified=None, response=None):