nodejs / nodejs/undici

Should SqliteCacheStore (and perhaps other cache stores) be hashing headers before storing?

Open
#4,122 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
JavaScript
Stars
7.7k
Forks
880
Avg merge
2d 16h
Merged PRs (30d)
68

Description

Currently SqliteCacheStore writes plaintext headers to disk.

Would it be better to hash cache keys? This might have other advantages, such as faster lookup and lower storage size, but would also introduce risk of clashes.

Repro

Adapted from test/cache-interceptor/sqlite-cache-store-tests.js.

'use strict'

const { test, skip } = require('node:test')
const { doesNotMatch, notEqual, strictEqual, deepStrictEqual } = require('node:assert')
const { readFile, rm } = require('node:fs/promises')
const { cacheStoreTests, writeBody, compareGetResults } = require('./cache-store-test-utils.js')

let hasSqlite = false
try {
  require('node:sqlite')

  const SqliteCacheStore = require('../../lib/cache/sqlite-cache-store.js')
  cacheStoreTests(SqliteCacheStore)
  hasSqlite = true
} catch (err) {
  if (err.code === 'ERR_UNKNOWN_BUILTIN_MODULE') {
    skip('`node:sqlite` not present')
  } else {
    throw err
  }
}

test('SqliteCacheStore hashes key contents', async (t) => {
  if (!hasSqlite) {
    t.skip()
    return
  }

  const SqliteCacheStore = require('../../lib/cache/sqlite-cache-store.js')
  const sqliteLocation = 'cache-interceptor.sqlite'

  const store = new SqliteCacheStore({
    location: sqliteLocation
  })

  t.after(async () => {
    //await rm(sqliteLocation)
  })

  /**
   * @type {import('../../types/cache-interceptor.d.ts').default.CacheKey}
   */
  const key = {
    origin: 'localhost',
    path: '/',
    method: 'GET',
    headers: {}
  }

  /**
   * @type {import('../../types/cache-interceptor.d.ts').default.CacheValue}
   */
  const value = {
    statusCode: 200,
    statusMessage: '',
    headers: { foo: 'bar', Authorization: 'topsecret' },
    cachedAt: Date.now(),
    staleAt: Date.now() + 10000,
    deleteAt: Date.now() + 20000,
    body: Buffer.from('asd')
  }

  store.set(key, value)

  store.close()

  doesNotMatch(await readFile(sqliteLocation, { encoding:'utf8' }), /topsecret/);
})

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with lib/cache/sqlite-cache-store.js and the adapted test in test/cache-interceptor/sqlite-cache-store-tests.js. Read the cache-store test utilities and run the SQLite cache-store tests; done should define whether cache keys or stored headers are protected from plaintext exposure while preserving existing cache behavior and addressing collision risk.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, sqlite
Domain
databases
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.