litespeedtech / litespeedtech/lscache_wp

REST API is cached although this was forbidden

Open
#413 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
257
Forks
123
PR merge metrics
No merged PRs in 30d

Description

Hey!

We have registered a custom `GET` REST API endpoint with `register_rest_route` and forbid to cache the result with the following headers: `no-cache, no-store, must-revalidate, max-age=0`.

In general, WordPress does this [by default when the user is logged-in](https://github.com/WordPress/WordPress/blob/42769ea145a818ece0cf263aab7e567f3fa25cb2/wp-includes/rest-api/class-wp-rest-server.php#L333-L349).

Now, if we have enabled the "Cache REST API" functionality in LiteSpeed Cache it gets a cache-hit even with the `no-cache` / `no-store` directive:

![image](https://user-images.githubusercontent.com/1008534/140295744-5b3b76bf-fde8-4f2c-be99-e732c278b9b0.png)

Should this be the expected behavior? If yes, is there a way to skip the LiteSpeed Cache for a specific request? Or via custom filter? 😊

From my opinion, LiteSpeed should respect the `no-cache` directive and not provide a cache hit for this.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the issue with a custom GET endpoint registered through register_rest_route while the Cache REST API functionality is enabled and the response sends the listed no-cache headers. Trace the REST API cache handling to determine whether those directives or a request-specific exclusion should prevent the cache hit. Done means the endpoint does not return a cache hit when caching is forbidden, with the behavior covered by an appropriate regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, wordpress
Domain
api, performance
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.