We should add HTTP Cache-Control headers when we server requests, so that clients will cache and re-use content. This will both help clients get the results more quickly (because they'll already have them) and also reduce load on the server (because there are fewer requests).
What's better than a plaintext query? An encrypted query.
What's better than an encrypted query? A query that never gets sent. It's impossible to crack a request that didn't happen.
Can we just use the cherrypy config setting to turn this on, or are we better off adding specific headers ourselves?
It might be useful to set the header expiry to just after the scan process finishes, so the client doesn't have to re-query until the data has changed (though we may have to be careful with client privacy there - set the expiry time in 1-hour chunks, and not down-to-the-second times). But even adding, say, one hour of client caching might help a lot at increasing client responsiveness and reducing server load.
We should add HTTP Cache-Control headers when we server requests, so that clients will cache and re-use content. This will both help clients get the results more quickly (because they'll already have them) and also reduce load on the server (because there are fewer requests).
What's better than a plaintext query? An encrypted query. What's better than an encrypted query? A query that never gets sent. It's impossible to crack a request that didn't happen.
Some primers on the header settings:
Can we just use the cherrypy config setting to turn this on, or are we better off adding specific headers ourselves?
It might be useful to set the header expiry to just after the scan process finishes, so the client doesn't have to re-query until the data has changed (though we may have to be careful with client privacy there - set the expiry time in 1-hour chunks, and not down-to-the-second times). But even adding, say, one hour of client caching might help a lot at increasing client responsiveness and reducing server load.