[BUG] Cache plugin key ignores HTTP method and request body
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
### Search before asking
- [x] I had searched in the [issues](https://github.com/apache/shenyu/issues) and found no similar issues.
### Apache ShenYu Component
shenyu-plugin
### What happened
`CacheUtils.dataKey(...)` builds the cache key only from query string and raw path:
```java
public static String dataKey(final ServerWebExchange exchange) {
URI uri = exchange.getRequest().getURI();
return DigestUtils.md5Hex(String.join(KEY_JOIN_RULE, uri.getQuery(), uri.getRawPath()));
}
```
The HTTP method, request body, and other request-varying inputs are not included. The cache plugin itself does not restrict caching to idempotent `GET` requests. As a result, different requests to the same path/query can reuse the same cache entry.
For example, these requests share the same cache key even though they can produce different upstream responses:
```text
POST /orders/quote
{"sku":"A","quantity":1}
```
```text
POST /orders/quote
{"sku":"B","quantity":1}
```
The second request can receive the first request's cached body.
### Expected behavior
Cache keys should include the dimensions that affect the upstream response, or the plugin should clearly restrict and validate cache usage to request shapes where path/query is sufficient. At minimum, the HTTP method should be part of the key, and body-sensitive methods should either include a body hash or be rejected unless a configured cache-key expression is provided.
### How to reproduce
1. Enable the cache plugin for an endpoint that accepts `POST` requests.
2. Send a `POST` request to `/orders/quote` with one body and let it be cached.
3. Send another `POST` request to the same path/query but with a different body.
4. The second request uses the same `CacheUtils.dataKey(...)` value and can receive the first response from cache.
### Debug logs
_No response_
### Environment
Current `master` branch.
### Are you willing to submit a PR?
- [ ] Yes I am willing to submit a PR!
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at the CacheUtils.dataKey(...) entry point and read how the cache plugin constructs and consumes its keys for POST requests. Reproduce the two differing request bodies described in the issue, then verify that the completed change prevents an incorrect cache hit by varying the method or body as required.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend, performance
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100