HttpTransferCache collapses distinct binary POST bodies into the same cache key
- Dominant language
- TypeScript
- Stars
- 101k
- Forks
- 27.5k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 288
Description
### Which @angular/* package(s) are the source of the bug?
common / http
### Is this a regression?
No
### Description
With POST requests enabled in `HttpTransferCache`, two requests with different binary bodies can end up sharing one cache entry. This matters for valid POST-based APIs such as Protobuf and gRPC, where the request body carries the input. The same cache-key rule also applies to other POST APIs, including GraphQL requests.
I reproduced this with two read-only Protobuf requests to the same URL. The bodies are valid, but different:
```text
document 100: 0864 document 200: 08c801
```
Angular should treat these as separate requests and cache their responses separately. Instead, the request for document `200` gets the cached response for document `100`; it never reaches the origin.
```ts
else if (typeof serializedBody !== 'string') {
serializedBody = '';
}
```
`HttpRequest.serializeBody()` returns a `Blob` as-is. Because a `Blob` is not a string, `makeCacheKey()` turns it into `''`. That means both Protobuf payloads have the same cache-key input before hashing.
### Please provide a link to a minimal reproduction of the bug
See Repository: https://github.com/SkyZeroZx/angular-protobuf-transfercache-poc
Contributor guide
Research direction
Start in common/http by tracing makeCacheKey and HttpRequest.serializeBody(), then reproduce the issue with the linked angular-protobuf-transfercache-poc. Done means distinct binary POST bodies produce distinct cache keys and their responses are not shared.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- angular, typescript
- Domain
- api, performance
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100