litespeedtech / litespeedtech/lscache_wp
REST API is cached although this was forbidden
- Dominant language
- PHP
- Stars
- 257
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
Hey!
We have registered a custom `GET` REST API endpoint with `register_rest_route` and forbid to cache the result with the following headers: `no-cache, no-store, must-revalidate, max-age=0`.
In general, WordPress does this [by default when the user is logged-in](https://github.com/WordPress/WordPress/blob/42769ea145a818ece0cf263aab7e567f3fa25cb2/wp-includes/rest-api/class-wp-rest-server.php#L333-L349).
Now, if we have enabled the "Cache REST API" functionality in LiteSpeed Cache it gets a cache-hit even with the `no-cache` / `no-store` directive:

Should this be the expected behavior? If yes, is there a way to skip the LiteSpeed Cache for a specific request? Or via custom filter? 😊
From my opinion, LiteSpeed should respect the `no-cache` directive and not provide a cache hit for this.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the issue with a custom GET endpoint registered through register_rest_route while the Cache REST API functionality is enabled and the response sends the listed no-cache headers. Trace the REST API cache handling to determine whether those directives or a request-specific exclusion should prevent the cache hit. Done means the endpoint does not return a cache hit when caching is forbidden, with the behavior covered by an appropriate regression test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php, wordpress
- Domain
- api, performance
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100