Skip to content

Cache save(...) does not correctly handle no-cache directive #183

@Cooksauce

Description

@Cooksauce

RFC: https://www.rfc-editor.org/rfc/rfc7234#section-5.2.2.2

The "no-cache" response directive indicates that the response MUST
NOT be used to satisfy a subsequent request without successful
validation on the origin server. This allows an origin server to
prevent a cache from using it to satisfy a request without contacting
it, even by caches that have been configured to send stale responses.

Problem Scenario:

  1. a previous response to a request had a cacheable cache-control header value... thus, has been stored via save(...)
  2. for some reason, this is no longer desired... so a change is made to is made to a subsequent response in which a no-cache value is in the response header
  3. when save(...) is called, it should have the effect of "busting" the originally cached value... the current implementation effectively no-ops here

Effect

In the most extreme case, this can lead to a significant security issue if the cache needs to be busted for security reasons.
(From testing, the Cloudflare caching "Purge Everything" UI functionality does not clear this.)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions