Pages cache not working (neither stored not used) when checking for logged in user

[sylvainjule]

Description

Having read @lukasbestle's explanation in #4423, I figured the following would work. This thread in the forum suggests this should work too so I'm mentioning this as an issue. Starting with a fresh starterkit, I activate the cache in config.php:

'cache' => [
    'pages' => [
        'active' => true
    ]
]

Pages are stored. Let's say I want to add the ability for my logged in users to have an edit button available on any front-end page which redirects to this very same page in the panel. I clear the cache and I add in my header.php:

<?php if(kirby()->user()): ?>
    <a class="edit" href="<?php echo $page->panel()->url() ?>">Edit content</a>
<?php endif; ?>

As soon as I do, the cache stops storing pages, the Cache-Control: no-store, private header is always set despite me not being logged in. Here's a video of this:

Enregistrement.de.l.ecran.2022-09-08.a.12.20.31.mp4

Your setup

Kirby 3.7.5

[lukasbestle]

@sylvainjule @LaurentTacco Could you please try if the following change in line 276 of kirby/src/Http/Request.php fixes it for you:

-		return $header !== null;
+		return empty($header) === false;

Explanation: The old line considers an empty but existing HTTP_AUTHORIZATION value as active, which is of course not true.

[LaurentTacco]

@lukasbestle By changing this line, cache seems to finally work as expected on my side! Thanks!!

[sylvainjule]

Same here! Thanks @lukasbestle!

[lukasbestle]

@LaurentTacco Could you please also check if changing the SetEnvIf line in .htaccess from (.*) to (.+) fixes it (without the change in the core)?

[LaurentTacco]

@lukasbestle Without changing anything in the core and by having SetEnvIf Authorization "(.+)" HTTP_AUTHORIZATION=$1 in the .htaccess everything works perfectly.

[lukasbestle]

Great, thanks for the quick reply.

Then we'll fix it in both places. The .htaccess change ensures that no empty headers are inserted if no header was passed, while the core change ensures that any empty header (no matter where it comes from) won't break the behavior.

[LaurentTacco]

You're welcome!

[bastianallgeier]

✅