tech5usa / TLSential

A server for providing short-lived TLS certificates to all services within a firewall restricted network.
GNU General Public License v3.0
15 stars 2 forks source link

Debus/client cache #53

Closed debus closed 4 years ago

debus commented 4 years ago

Context

Cert objects are rarely modified, so clients are easily able to cache them. This PR adds a ModTime field to cert objects which is updated everytime the cert is written to the database. When we respond to requests for /api/certificate/{id}/(privkey|issuer|cert) we set the modtime and the server object will automatically set a Last-Modified header. as well as handles Range requests properly, sets the MIME type, and handles If-Match, If-Unmodified-Since, If-None-Match, If-Modified-Since, and If-Range requests.

Testing

Made requests and made sure the the last-modified header was set, as well as making sure it returned a 304 if I set If-Modified-Since to a time after last-modified

Misc.

Not sure if we want to ServeContent with the GetCertificate and GetAllCertificates methods, so that we get this behavior? Although for GetAllCertificates we'd probably have to track the newest ModTime while looping through the certs