kornelski / http-cache-semantics

RFC 7234 in JavaScript. Parses HTTP headers to correctly compute cacheability of responses, even in complex cases
http://httpwg.org/specs/rfc7234.html
BSD 2-Clause "Simplified" License
244 stars 27 forks source link

pragma=no-cache is ignored when cache-control is present #23

Closed gajus closed 4 years ago

gajus commented 5 years ago
cache-control: max-age=600, must-revalidate, post-check=0, pre-check=0, public
date: Mon, 15 Jul 2019 11:42:17 GMT
pragma: no-cache

From this website:

https://www.odeon.co.uk/booking/init/MjkxMjQwMDAwMjNJV0ZDT1BGIzEwMiMxODQ5Ng==/

Not sure what is the expected behaviour here, but I would expect that given that pragma: no-cache is present, then it should't be safe to cache the response regardless of cache-control. Meanwhile,

> cachePolicy.storable()
true
> cachePolicy.timeToLive()
600000
kornelski commented 5 years ago

There's ignoreCargoCult: true option enabled by default. This is my extension. If Cache-Control contains pre-check, then all cacheability information is ignored based on assumption that the author of that header doesn't know what they're doing.

pre-check is an ancient IE5 directive applicable only to cached responses. It doesn't make any sense to use it, ever. Even in IE5 0 was the default. For the last 20 years everyone just copies the same bad StackOverflow answers and PHP snippets based on superstition.

gajus commented 5 years ago

This is my extension. If Cache-Control contains pre-check, then all cacheability information is ignored based on assumption that the author of that header doesn't know what they're doing.

So, shouldn't cachePolicy.storable() return false then?

kornelski commented 5 years ago

You can store almost all responses, even expired ones. Someone could ask for an expired response with max-stale in the request. Or an expired response can be revalidated and made fresh with status 304.