You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The "no-cache" response directive indicates that the response MUST
NOT be used to satisfy a subsequent request without successful
validation on the origin server. This allows an origin server to
prevent a cache from using it to satisfy a request without contacting
it, even by caches that have been configured to send stale responses.
Problem Scenario:
a previous response to a request had a cacheable cache-control header value... thus, has been stored via save(...)
for some reason, this is no longer desired... so a change is made to is made to a subsequent response in which a no-cache value is in the response header
when save(...) is called, it should have the effect of "busting" the originally cached value... the current implementation effectively no-ops here
Effect
In the most extreme case, this can lead to a significant security issue if the cache needs to be busted for security reasons.
(From testing, the Cloudflare caching "Purge Everything" UI functionality does not clear this.)
The text was updated successfully, but these errors were encountered:
RFC: https://www.rfc-editor.org/rfc/rfc7234#section-5.2.2.2
Problem Scenario:
cache-control
header value... thus, has been stored viasave(...)
no-cache
value is in the response headersave(...)
is called, it should have the effect of "busting" the originally cached value... the current implementation effectively no-ops hereEffect
In the most extreme case, this can lead to a significant security issue if the cache needs to be busted for security reasons.
(From testing, the Cloudflare caching "Purge Everything" UI functionality does not clear this.)
The text was updated successfully, but these errors were encountered: