apache / apache/shenyu

[BUG] Cache plugin key ignores HTTP method and request body

Open
#6,506 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

### Search before asking

- [x] I had searched in the [issues](https://github.com/apache/shenyu/issues) and found no similar issues.

### Apache ShenYu Component

shenyu-plugin

### What happened

`CacheUtils.dataKey(...)` builds the cache key only from query string and raw path:

```java
public static String dataKey(final ServerWebExchange exchange) {
URI uri = exchange.getRequest().getURI();
return DigestUtils.md5Hex(String.join(KEY_JOIN_RULE, uri.getQuery(), uri.getRawPath()));
}
```

The HTTP method, request body, and other request-varying inputs are not included. The cache plugin itself does not restrict caching to idempotent `GET` requests. As a result, different requests to the same path/query can reuse the same cache entry.

For example, these requests share the same cache key even though they can produce different upstream responses:

```text
POST /orders/quote
{"sku":"A","quantity":1}
```

```text
POST /orders/quote
{"sku":"B","quantity":1}
```

The second request can receive the first request's cached body.

### Expected behavior

Cache keys should include the dimensions that affect the upstream response, or the plugin should clearly restrict and validate cache usage to request shapes where path/query is sufficient. At minimum, the HTTP method should be part of the key, and body-sensitive methods should either include a body hash or be rejected unless a configured cache-key expression is provided.

### How to reproduce

1. Enable the cache plugin for an endpoint that accepts `POST` requests.
2. Send a `POST` request to `/orders/quote` with one body and let it be cached.
3. Send another `POST` request to the same path/query but with a different body.
4. The second request uses the same `CacheUtils.dataKey(...)` value and can receive the first response from cache.

### Debug logs

_No response_

### Environment

Current `master` branch.

### Are you willing to submit a PR?

- [ ] Yes I am willing to submit a PR!

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the CacheUtils.dataKey(...) entry point and read how the cache plugin constructs and consumes its keys for POST requests. Reproduce the two differing request bodies described in the issue, then verify that the completed change prevents an incorrect cache hit by varying the method or body as required.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend, performance
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.