ledgetech / ledge

An RFC compliant and ESI capable HTTP cache for Nginx / OpenResty, backed by Redis
454 stars 59 forks source link

Feature to blacklist cookies from esi evaluation #188

Closed pintsized closed 4 years ago

pintsized commented 4 years ago

Cookies will still always be sent to subrequests for ESI includes (unless disabled in another way), but any cookies blacklisted will not evaluated in or inside other esi tags, to prevent accidental exposure of sensitive data.

This required a little refactoring, which will result in a small performance increase on pages with lots of ESI cookie expansion.