Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

spring-web: Cannot create Cache-Control: no-store, no-cache with new CacheControl API [SPR-13780] #18354

Closed
spring-projects-issues opened this issue Dec 9, 2015 · 8 comments
Assignees
Labels
in: web status: declined type: enhancement

Comments

@spring-projects-issues
Copy link
Collaborator

spring-projects-issues commented Dec 9, 2015

Thomas Tardy opened SPR-13780 and commented

We are migrating a project from spring-web 4.1.8 to 4.2.3 and need to replace the deprecated code

WebContentInterceptor interceptor = new WebContentInterceptor();
interceptor.setCacheSeconds(0);
interceptor.setUseExpiresHeader(true);
interceptor.setUseCacheControlHeader(true);
interceptor.setUseCacheControlNoStore(true);

with the usage of the new CacheControl and interceptor.setCacheControl(cacheControl).

But with the new API of CacheControl, you cannot use noStore() and noCache() together as these methods return a new CacheControl and aren't updating the existing ones.

As it is still required to set the Cache-Control header to no-store, no-cache to disable caching in different browsers, this should be possible.


Affects: 4.2.3

@spring-projects-issues
Copy link
Collaborator Author

spring-projects-issues commented Dec 9, 2015

Brian Clozel commented

Hi Thomas Tardy
Out of curiosity, which use cases/browsers require both no-store and no-cache?

@spring-projects-issues
Copy link
Collaborator Author

spring-projects-issues commented Dec 9, 2015

Thomas Tardy commented

Older browsers doesn't correctly support no-cache and no-store is required in addition. See http://stackoverflow.com/questions/866822/why-both-no-cache-and-no-store-should-be-used-in-http-response

@spring-projects-issues
Copy link
Collaborator Author

spring-projects-issues commented Dec 9, 2015

Brian Clozel commented

I don't see any reference stating that "Cache-Control: no-store" does not work with old browsers.
If anything, people are stating that some versions of IE are reusing previous responses when using the back button and "no-cache"; even if it's not a proper behavior, it's does not strictly go against the spec, since "no-cache" means caching the response but revalidating it with the server before reusing it and "no-store" means no caching at all. In old versions of IE, the browser seemed to wrongly handle "no-cache" as "no-store", when it should have sent conditional requests to revalidate the cached response.

When deciding on those static methods, I looked hard and found no evidence of "no-store" not working on some browsers, but rather tons of advice stating that you should stack up directives like "Cache-Control: must-revalidate, no-cache, no-store, max-age=0" + "Expires: [date in past]" + "Pragma: no-cache".

Do you have a reference that states that some browser versions don't support "no-store"?
If "no-store" works out of the box for all browsers, do you see other reasons to combine both?

Thanks!

@spring-projects-issues
Copy link
Collaborator Author

spring-projects-issues commented Dec 10, 2015

Thomas Tardy commented

... but rather tons of advice stating that you should stack up directives like "Cache-Control: must-revalidate, no-cache, no-store, max-age=0" + "Expires: [date in past]" + "Pragma: no-cache"

How would you do that with the CacheControl API?

@spring-projects-issues
Copy link
Collaborator Author

spring-projects-issues commented Dec 10, 2015

Brian Clozel commented

You can't, that's the point. This API has been designed to help developers make the right decision. When I'm referring to "stacking up directives", I think this is a wrong thing to recommend since you're sending mixed signals to HTTP clients.

For me it doesn't make sense to use "no-store" and "no-cache" at the same time, since they mean different things and I've found no proof whatsoever stating that you should use both for a specific compatibility version. You can check the latest recommendations for HTTP caching by Google and Mark Nottingham.

Now I'm just trying to make the right choice: should we open this possibility because it's actually useful? Or should we leave it as it is because using both directives is some kind of anti-pattern. Do you know if a particular HTTP client/browser needs that combination? I'd be happy to test it.

Thanks,

@spring-projects-issues
Copy link
Collaborator Author

spring-projects-issues commented Dec 10, 2015

Thomas Tardy commented

Do you know if a particular HTTP client/browser needs that combination?

No, I'm not. We should be fine with "no-store". You can close this ticket.

Thanks a lot for your quick responses and your support!

@spring-projects-issues
Copy link
Collaborator Author

spring-projects-issues commented Dec 11, 2015

Brian Clozel commented

Thanks for this report Thomas Tardy, don't hesitate to reopen/create a new issue if you find something new.
Feedback from Spring developers is always great.

@spring-projects-issues
Copy link
Collaborator Author

spring-projects-issues commented Feb 4, 2016

Aurélien Leboulanger commented

If the no-cache + no-store mention isn't supported by the CacheControl API builder, please remove this comment from the javadoc of the noCache method to avoid mistakes (and to avoid people to try to use both noCache and noStore at the same time):

/**
          [...] 
	 * <p>In order to disable caching and minimize requests/responses exchanges, the {@link #noStore()} directive
	 * should be used.
         [...]
	 */

@spring-projects-issues spring-projects-issues added status: declined type: enhancement in: web labels Jan 11, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: web status: declined type: enhancement
Projects
None yet
Development

No branches or pull requests

2 participants