Cache `save(...)` does not correctly handle `no-cache` directive
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1.7k
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
RFC: https://www.rfc-editor.org/rfc/rfc7234#section-5.2.2.2
> The "no-cache" response directive indicates that the response MUST
NOT be used to satisfy a subsequent request without successful
validation on the origin server. This allows an origin server to
prevent a cache from using it to satisfy a request without contacting
it, even by caches that have been configured to send stale responses.
## Problem Scenario:
1. a previous response to a request had a cacheable `cache-control` header value... thus, has been stored via `save(...)`
2. for some reason, this is no longer desired... so a change is made to is made to a subsequent response in which a `no-cache` value is in the response header
3. when `save(...)` is called, it should have the effect of "busting" the originally cached value... the current implementation effectively no-ops here
#### Effect
In the most extreme case, this can lead to a significant security issue if the cache needs to be busted for security reasons.
(_From testing, the Cloudflare caching "Purge Everything" UI functionality does not clear this._)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the cache implementation and the save(...) entry point, then compare its handling of cache-control with RFC 7234 section 5.2.2.2. Reproduce the two-response scenario described in the issue and verify that a later no-cache response prevents the previously stored value from satisfying requests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- backend, cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100