HTTP 304 being returned when Etag doesn't match

[edmorley]

Hi!

Currently WhiteNoise:

• includes both an Etag and Last-Modified header on all responses
• checks incoming requests to see if they specified a If-None-Match (used for Etag) or If-Modified-Since header, to determine whether to return an HTTP 304 response

However the current implementation falls back to If-Modified-Since even if there was a non-matching If-None-Match, rather than returning false:

whitenoise/whitenoise/responders.py

Lines 169 to 176 in 1b5a7f3

	def is_not_modified(self, request_headers):
	if self.etag == request_headers.get('HTTP_IF_NONE_MATCH'):
	return True
	try:
	last_requested = request_headers['HTTP_IF_MODIFIED_SINCE']
	except KeyError:
	return False
	return parsedate(last_requested) >= self.last_modified

This is problematic since:

• browsers (at least Firefox and Chrome, haven't checked the rest) always send both sets of headers
• If-Modified-Since is unreliable in the case of deployment rollbacks (since by design the comparison is greater than or equal to modified time, rather than just equal to)

Demo:

curl -I https://treeherder.mozilla.org/ \
  -H 'If-None-Match: "this-will-not-match"' \
  -H 'If-Modified-Since: Thu, 25 Oct 2099 16:00:44 GMT'

Currently this returns HTTP 304 even though it has a non-matching If-None-Match header value.

This caused frontend breakage after a rollback we performed today, which persisted until users force-refreshed:

---