lukeed / lukeed/worktop

Cache `save(...)` does not correctly handle `no-cache` directive

Open
#183 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
1.7k
Forks
41
PR merge metrics
No merged PRs in 30d

Description

RFC: https://www.rfc-editor.org/rfc/rfc7234#section-5.2.2.2
> The "no-cache" response directive indicates that the response MUST
NOT be used to satisfy a subsequent request without successful
validation on the origin server. This allows an origin server to
prevent a cache from using it to satisfy a request without contacting
it, even by caches that have been configured to send stale responses.

## Problem Scenario:
1. a previous response to a request had a cacheable `cache-control` header value... thus, has been stored via `save(...)`
2. for some reason, this is no longer desired... so a change is made to is made to a subsequent response in which a `no-cache` value is in the response header
3. when `save(...)` is called, it should have the effect of "busting" the originally cached value... the current implementation effectively no-ops here

#### Effect
In the most extreme case, this can lead to a significant security issue if the cache needs to be busted for security reasons.
(_From testing, the Cloudflare caching "Purge Everything" UI functionality does not clear this._)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the cache implementation and the save(...) entry point, then compare its handling of cache-control with RFC 7234 section 5.2.2.2. Reproduce the two-response scenario described in the issue and verify that a later no-cache response prevents the previously stored value from satisfying requests.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
backend, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.