Issue #2888853 by vaplas, Wim Leers: FileAccessControlHandler cacheability metadata inaccurate

core/modules/file/src/FileAccessControlHandler.php

@@ -52,11 +52,11 @@ protected function checkAccess(EntityInterface $entity, $operation, AccountInter
           //   services can be more properly injected.
           $allowed_fids = \Drupal::service('session')->get('anonymous_allowed_file_ids', []);
           if (!empty($allowed_fids[$entity->id()])) {
-            return AccessResult::allowed();
+            return AccessResult::allowed()->addCacheContexts(['session', 'user']);
           }
         }
         else {
-          return AccessResult::allowed();
+          return AccessResult::allowed()->addCacheContexts(['user']);
         }
       }
     }

core/modules/file/tests/src/Kernel/AccessTest.php

@@ -123,4 +123,28 @@ public function testCreateAccess() {
     $this->assertFalse($this->file->access('create'));
   }
 
+  /**
+   * Tests cacheability metadata.
+   */
+  public function testFileCacheability() {
+    $file = File::create([
+      'filename' => 'green-scarf',
+      'uri' => 'private://green-scarf',
+      'filemime' => 'text/plain',
+      'status' => FILE_STATUS_PERMANENT,
+    ]);
+    $file->save();
+    \Drupal::service('session')->set('anonymous_allowed_file_ids', [$file->id() => $file->id()]);
+
+    $account = User::getAnonymousUser();
+    $file->setOwnerId($account->id())->save();
+    $this->assertSame(['session', 'user'], $file->access('view', $account, TRUE)->getCacheContexts());
+    $this->assertSame(['session', 'user'], $file->access('download', $account, TRUE)->getCacheContexts());
+
+    $account = $this->user1;
+    $file->setOwnerId($account->id())->save();
+    $this->assertSame(['user'], $file->access('view', $account, TRUE)->getCacheContexts());
+    $this->assertSame(['user'], $file->access('download', $account, TRUE)->getCacheContexts());
+  }
+
 }