HTTP cache support for the QUERY method (RFC 10008)#852
Conversation
|
@hunghhdev Awesome! Out of curiosity is this effort coordinated with the original author of #840 or is it purely coincidental? Please note there is #850 that still needs to land that improves the process of cache key generation. Overall looks very good. |
No, this PR was not coordinated, I just saw this. If you prefer this code instead, I can stop #846. |
| * by {@link AsyncEntityProducer#releaseResources()} and can still be used to execute | ||
| * the request directly. | ||
| */ | ||
| private static byte[] drainEntityProducer(final AsyncEntityProducer entityProducer) throws IOException { |
There was a problem hiding this comment.
@hunghhdev When draining the entity producer we should enforce a total cap on body length in order to avoid some "security professional" reporting it as a potential DoS vulnerability. I imagine requests with content body larger than 25K should be considered non-cacheable
| } | ||
| // QUERY content must be read in full in order to determine the cache key | ||
| if (Method.QUERY.isSame(request.getMethod()) && entity.getContentEncoding() == null) { | ||
| final byte[] content = EntityUtils.toByteArray(entity); |
There was a problem hiding this comment.
@hunghhdev Likewise, we should avoid buffering of content body larger than 25K. That also makes it necessary for the content entity to be repeatable.
@desiderantes This is the first time we, as a project, have multiple contributions of the same feature. I suggest we proceed with @hunghhdev contribution as it is almost complete and it is a first-time contribution. In the meantime, if you have time and inclination what also needs to be done is to extend |
3 participants
Follow-up to #840. The caching layer can now store and serve responses to
QUERYrequests: cache keys incorporate a digest of the request content and content type, and both classic and async interceptors bufferQUERYbodies instead of bypassing the cache. Anything that cannot be buffered safely still falls back to direct execution.