MAGETWO-90308: Wrong page cached for logged in user

Author: ameysar

app/etc/di.xml

@@ -1660,4 +1660,9 @@
     </type>
     <!-- \Magento\Framework\MessageQueue\Bulk\PublisherPool is @api -->
     <virtualType name="Magento\Framework\MessageQueue\Bulk\PublisherPool" type="Magento\Framework\MessageQueue\PublisherPool" />
+    <type name="Magento\Framework\Session\Config">
+        <arguments>
+            <argument name="scopeType" xsi:type="const">Magento\Framework\App\Config\ScopeConfigInterface::SCOPE_TYPE_DEFAULT</argument>
+        </arguments>
+    </type>
 </config>

lib/internal/Magento/Framework/App/Response/Http.php

@@ -9,10 +9,12 @@
 
 use Magento\Framework\App\Http\Context;
 use Magento\Framework\App\ObjectManager;
+use Magento\Framework\Stdlib\Cookie\CookieMetadata;
 use Magento\Framework\Stdlib\Cookie\CookieMetadataFactory;
 use Magento\Framework\Stdlib\CookieManagerInterface;
 use Magento\Framework\Stdlib\DateTime;
 use Magento\Framework\App\Request\Http as HttpRequest;
+use Magento\Framework\Session\Config\ConfigInterface;
 
 class Http extends \Magento\Framework\HTTP\PhpEnvironment\Response
 {
@@ -50,25 +52,33 @@ class Http extends \Magento\Framework\HTTP\PhpEnvironment\Response
      */
     protected $dateTime;
 
+    /**
+     * @var \Magento\Framework\Session\Config\ConfigInterface
+     */
+    private $sessionConfig;
+
     /**
      * @param HttpRequest $request
      * @param CookieManagerInterface $cookieManager
      * @param CookieMetadataFactory $cookieMetadataFactory
      * @param Context $context
      * @param DateTime $dateTime
+     * @param ConfigInterface|null $sessionConfig
      */
     public function __construct(
         HttpRequest $request,
         CookieManagerInterface $cookieManager,
         CookieMetadataFactory $cookieMetadataFactory,
         Context $context,
-        DateTime $dateTime
+        DateTime $dateTime,
+        ConfigInterface $sessionConfig = null
     ) {
         $this->request = $request;
         $this->cookieManager = $cookieManager;
         $this->cookieMetadataFactory = $cookieMetadataFactory;
         $this->context = $context;
         $this->dateTime = $dateTime;
+        $this->sessionConfig = $sessionConfig ?: ObjectManager::getInstance()->get(ConfigInterface::class);
     }
 
     /**
@@ -91,8 +101,11 @@ public function sendVary()
     {
         $varyString = $this->context->getVaryString();
         if ($varyString) {
-            $sensitiveCookieMetadata = $this->cookieMetadataFactory->createSensitiveCookieMetadata()->setPath('/');
-            $this->cookieManager->setSensitiveCookie(self::COOKIE_VARY_STRING, $varyString, $sensitiveCookieMetadata);
+            $cookieLifeTime = $this->sessionConfig->getCookieLifetime();
+            $sensitiveCookMetadata = $this->cookieMetadataFactory->createSensitiveCookieMetadata(
+                [CookieMetadata::KEY_DURATION => $cookieLifeTime]
+            )->setPath('/');
+            $this->cookieManager->setSensitiveCookie(self::COOKIE_VARY_STRING, $varyString, $sensitiveCookMetadata);
         } elseif ($this->request->get(self::COOKIE_VARY_STRING)) {
             $cookieMetadata = $this->cookieMetadataFactory->createSensitiveCookieMetadata()->setPath('/');
             $this->cookieManager->deleteCookie(self::COOKIE_VARY_STRING, $cookieMetadata);

lib/internal/Magento/Framework/App/Test/Unit/Response/HttpTest.php

@@ -8,6 +8,8 @@
 
 use Magento\Framework\App\Response\Http;
 use Magento\Framework\ObjectManagerInterface;
+use Magento\Framework\Session\Config\ConfigInterface;
+use Magento\Framework\Stdlib\Cookie\CookieMetadata;
 
 /**
  * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
@@ -49,6 +51,19 @@ class HttpTest extends \PHPUnit\Framework\TestCase
      */
     protected $objectManager;
 
+    /**
+     * @var ConfigInterface|\PHPUnit_Framework_MockObject_MockObject
+     */
+    private $sessionConfigMock;
+
+    /**
+     * @var int
+     */
+    private $cookieLifeTime = 3600;
+
+    /**
+     * @inheritdoc
+     */
     protected function setUp()
     {
         $this->objectManager = new \Magento\Framework\TestFramework\Unit\Helper\ObjectManager($this);
@@ -68,20 +83,28 @@ protected function setUp()
             ->disableOriginalConstructor()
             ->getMock();
 
+        $this->sessionConfigMock = $this->getMockBuilder(ConfigInterface::class)
+            ->disableOriginalConstructor()
+            ->getMockForAbstractClass();
+
         $this->model = $this->objectManager->getObject(
             \Magento\Framework\App\Response\Http::class,
             [
                 'request' => $this->requestMock,
                 'cookieManager' => $this->cookieManagerMock,
                 'cookieMetadataFactory' => $this->cookieMetadataFactoryMock,
                 'context' => $this->contextMock,
-                'dateTime' => $this->dateTimeMock
+                'dateTime' => $this->dateTimeMock,
+                'sessionConfig' => $this->sessionConfigMock,
             ]
         );
         $this->model->headersSentThrowsException = false;
         $this->model->setHeader('Name', 'Value');
     }
 
+    /**
+     * @inheritdoc
+     */
     protected function tearDown()
     {
         unset($this->model);
@@ -108,9 +131,14 @@ public function testSendVary()
             ->method('getVaryString')
             ->will($this->returnValue($expectedCookieValue));
 
+        $this->sessionConfigMock->expects($this->once())
+            ->method('getCookieLifetime')
+            ->willReturn($this->cookieLifeTime);
+
         $this->cookieMetadataFactoryMock->expects($this->once())
             ->method('createSensitiveCookieMetadata')
-            ->will($this->returnValue($sensitiveCookieMetadataMock));
+            ->with([CookieMetadata::KEY_DURATION => $this->cookieLifeTime])
+            ->willReturn($sensitiveCookieMetadataMock);
 
         $this->cookieManagerMock->expects($this->once())
             ->method('setSensitiveCookie')