set Expires headers

[vorpal-buildbot]

Reported on Discord by bakert#2193

[bakert]

Our CSS and JS use the querystring trick to cache bust so it's safe to give them far future Expires headers. But we currently do not (?)

 rsp = Response(r, content_type=content_type)
            rsp.headers.add('Expires', then.strftime("%a, %d %b %Y %H:%M:%S GMT"))
            rsp.headers.add('Cache-Control', 'public,max-age=%d' % int(3600 * hours))

[bakert]

prak pd] curl -v 'https://pennydreadfulmagic.com/static/css/pd.css?v=a9ac9671bf5d553ace959b8c5980dbcb30c5aeeb' 2>&1 | grep " expires:"
curl -v 'https://cdnjs.cloudflare.com/ajax/libs/moment-timezone/0.5.28/moment-timezone-with-data.min.js' 2>&1 | grep " expires:"
curl -v 'https://cdnjs.cloudflare.com/ajax/libs/react/16.13.1/umd/react.production.min.js' 2>&1 | grep " expires:"
curl -v 'https://cdnjs.cloudflare.com/ajax/libs/react-dom/16.13.1/umd/react-dom.production.min.js' 2>&1 | grep " expires:"
curl -v 'https://pennydreadfulmagic.com/static/js/tipped.min.js' 2>&1 | grep " expires:"
curl -v 'https://pennydreadfulmagic.com/static/js/pd.js?v=ca8069f385fc79624f432a60084e4234cf37eaac' 2>&1 | grep " expires:"
curl -v 'https://pennydreadfulmagic.com/static/dist/bundle.js?v=87dd9eeaf857b3da41892a8fa137a91b0cd07e7b' 2>&1 | grep " expires:"
curl -v 'https://www.googletagmanager.com/gtag/js?id=UA-109131120-1' 2>&1 | grep " expires:"
< expires: Fri, 14 Aug 2020 16:40:42 GMT
< expires: Wed, 04 Aug 2021 04:40:42 GMT
< expires: Wed, 04 Aug 2021 04:40:42 GMT
< expires: Wed, 04 Aug 2021 04:40:42 GMT
< expires: Fri, 14 Aug 2020 16:40:43 GMT
< expires: Fri, 14 Aug 2020 16:40:43 GMT
< expires: Fri, 14 Aug 2020 16:40:43 GMT
< expires: Fri, 14 Aug 2020 04:40:43 GMT

[bakert]

A lot of advice on the internet says to set this in NGINX or whatever is in front of Flask instead of in Flask.

[bakert]

@silasary maybe this is something we can do in CloudFlare? Or at least in front of Flask somehow?

[silasary]

Sure, I'll look into it

[bakert]

It's not quite as bad as it looks from the curls above. The cloudflare cdn-hosted libs DO set a 355 days cache-control header and their docs say the browser ignores "expires" if cache-control is present.

Our static resources have cache-control: no-cache however.

Some kind of negotiation is going on because I see the browser getting 304 Not Modified back grabbing the CSS. We seem to load banner.css on every page load? For me these mostly-pointless requests are taking about 75ms each. No idea if they are blocking anything. It would be nice to make them go away by sending the right headers

And all our static resources being served out of Flask are sending cookies with the response, but that's covered by #7461