Document that runserver --insecure doesn't work with DEBUG False and CachedStaticFilesStorage

[Apreche]

How to reproduce:

Enable the CachedStaticFilesStorage in your settings and turn DEBUG off.

DEBUG = False

STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.CachedStaticFilesStorage'

Turn on the runserver with the insecure flag

$ python manage.py runserver --insecure

Visit your runserver in your browser, and the static files will not load. When using the default django.contrib.staticfiles.storage.StaticFilesStorage the static files will load.

The reason is because of this section in contrib/staticfiles.storage.py

100     def url(self, name, force=false):
101         """
102         Returns the real URL in DEBUG mode.
103         """
104         if settings.DEBUG and not force:
105             hashed_name, fragment = name, ''
106         else:

When DEBUG is False, the automatic static file serving in runserver is disabled. But using runserver with --insecure will re-enable it. Because the CachedStaticFilesStorage only looks at the DEBUG flag, it will not work properly in this scenario. Perhaps that force parameter could be set to True when the --insecure flag is passed to runserver?

Yes, this is an extremely rare and low-priority edge case, but still a bug.

It's also not clear what the expected behavior is when both the --nostatic and --insecure flags are passed to runserver simultaneously. They sort of cancel each other out. Personally I feel the nostatic should take priority.

[Aymeric Augustin]

I can reproduce the issue, but I don't know how to fix it.

[Jannis Leidel]

I'm pretty sure you're way out of scope for both runserver and the CachedStaticFilesStorage. So to answer your question, to fix this "bug" stop using --insecure in the first place.

I'm accepting this ticket to warn users in the docs that both modes are incompatible.

[Tim Graham <timograham@…>]

In 028db9750357d504c55a7ac686c9abaa3c847ac6:

Fixed #19295 -- Documented that CachedStaticFilesStorage isn't compatible with runserver --insecure.

[Tim Graham <timograham@…>]

In afc624cab015be3c05dbe2c184416c4838db4b82:

[1.5.x] Fixed #19295 -- Documented that CachedStaticFilesStorage isn't compatible with runserver --insecure.

Backport of 028db97503 from master

[Tim Graham <timograham@…>]

In 2c73ba88f25230e9e62293d25de7526d018041e8:

[1.6.x] Fixed #19295 -- Documented that CachedStaticFilesStorage isn't compatible with runserver --insecure.

Backport of 028db97503 from master

[Tim Graham <timograham@…>]

In 4a861e88:

Refs #19295 -- Doc'd that ManifestStaticFilesStorage doesn't work with runserver --insecure.

[Tim Graham <timograham@…>]

In 36b4def9:

[2.0.x] Refs #19295 -- Doc'd that ManifestStaticFilesStorage doesn't work with runserver --insecure.

Backport of 4a861e88508eacdb8d0d5bc43f9a0576cedb9f22 from master