Should SqliteCacheStore (and perhaps other cache stores) be hashing headers before storing?
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 7.7k
- Forks
- 880
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 68
Description
Currently SqliteCacheStore writes plaintext headers to disk.
Would it be better to hash cache keys? This might have other advantages, such as faster lookup and lower storage size, but would also introduce risk of clashes.
Repro
Adapted from test/cache-interceptor/sqlite-cache-store-tests.js.
'use strict'
const { test, skip } = require('node:test')
const { doesNotMatch, notEqual, strictEqual, deepStrictEqual } = require('node:assert')
const { readFile, rm } = require('node:fs/promises')
const { cacheStoreTests, writeBody, compareGetResults } = require('./cache-store-test-utils.js')
let hasSqlite = false
try {
require('node:sqlite')
const SqliteCacheStore = require('../../lib/cache/sqlite-cache-store.js')
cacheStoreTests(SqliteCacheStore)
hasSqlite = true
} catch (err) {
if (err.code === 'ERR_UNKNOWN_BUILTIN_MODULE') {
skip('`node:sqlite` not present')
} else {
throw err
}
}
test('SqliteCacheStore hashes key contents', async (t) => {
if (!hasSqlite) {
t.skip()
return
}
const SqliteCacheStore = require('../../lib/cache/sqlite-cache-store.js')
const sqliteLocation = 'cache-interceptor.sqlite'
const store = new SqliteCacheStore({
location: sqliteLocation
})
t.after(async () => {
//await rm(sqliteLocation)
})
/**
* @type {import('../../types/cache-interceptor.d.ts').default.CacheKey}
*/
const key = {
origin: 'localhost',
path: '/',
method: 'GET',
headers: {}
}
/**
* @type {import('../../types/cache-interceptor.d.ts').default.CacheValue}
*/
const value = {
statusCode: 200,
statusMessage: '',
headers: { foo: 'bar', Authorization: 'topsecret' },
cachedAt: Date.now(),
staleAt: Date.now() + 10000,
deleteAt: Date.now() + 20000,
body: Buffer.from('asd')
}
store.set(key, value)
store.close()
doesNotMatch(await readFile(sqliteLocation, { encoding:'utf8' }), /topsecret/);
})
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with lib/cache/sqlite-cache-store.js and the adapted test in test/cache-interceptor/sqlite-cache-store-tests.js. Read the cache-store test utilities and run the SQLite cache-store tests; done should define whether cache keys or stored headers are protected from plaintext exposure while preserving existing cache behavior and addressing collision risk.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, sqlite
- Domain
- databases
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100