search

kaazing / http2-cache.js

2 stars 11 forks source link

Authorization Header is cached #54

Closed tejaede closed 6 years ago

tejaede commented 7 years ago

This is more of a question than a report as I am not sure whether this is the correct behavior. We certainly need to account for it though as it results in the following:

  1. Acquire JWT (say token1)
  2. Poll get_hazards with JWT
  3. Cache valid responses as they arrive
  4. Acquire new JWT (say token2) before token1 expires
  5. Continue polling with token2

Expected: token2 is sent to accelerator and we see no break in service. Actual: token1 is sent to accelerator until it gets a 403 or we send the no-cache directive.

For the time being, we can detect whether the token has changed and, if so, include the no-cache directive.

tejaede commented 7 years ago

UPDATE: Sending the no-cache directive is actually not an effective strategy. The original token continues to be sent. This appears to be a similar issue to https://github.com/kaazing/http2-cache.js/issues/53 in that an uncacheable request is not invalidating the existing cached request.

tejaede commented 7 years ago

@hthetiot @dpwspoon

After discussing with Jonathan, I need to amend my comments this morning. It's clear we are going to need to proactively send new tokens through the accelerator before we get a 403. Contour acquires a new token whenever it receives a 403 response so if each endpoint must receive a 403 before it can use a new token, we end up in an infinite loop of token retrieval.

The following is a reasonable use case for Contour:

  1. Acquire token1
  2. Start polling /hazards and /features with token1.
  3. token1 expires
    • Infinite loop starts here
  4. /hazards push promise comes back with 403, triggering a new token: token2
  5. Start polling /hazards and /features from client with token2.
    • DA still uses token1 for /features
  6. /features push promise comes back with 403, triggering a new token: token3
    • acquiring token3 invalidates token2.
  7. Start polling /hazards and /features from client with token3.
    • DA still uses token2 for /hazards
  8. /hazards push promise comes back with 403, triggering a new token: token4
    • DA still uses token3 for /features

And so on...