-
-
Notifications
You must be signed in to change notification settings - Fork 43
Open
Description
RFC: https://www.rfc-editor.org/rfc/rfc7234#section-5.2.2.2
The "no-cache" response directive indicates that the response MUST
NOT be used to satisfy a subsequent request without successful
validation on the origin server. This allows an origin server to
prevent a cache from using it to satisfy a request without contacting
it, even by caches that have been configured to send stale responses.
Problem Scenario:
- a previous response to a request had a cacheable
cache-controlheader value... thus, has been stored viasave(...) - for some reason, this is no longer desired... so a change is made to is made to a subsequent response in which a
no-cachevalue is in the response header - when
save(...)is called, it should have the effect of "busting" the originally cached value... the current implementation effectively no-ops here
Effect
In the most extreme case, this can lead to a significant security issue if the cache needs to be busted for security reasons.
(From testing, the Cloudflare caching "Purge Everything" UI functionality does not clear this.)
Metadata
Metadata
Assignees
Labels
No labels