search

umbraco / Umbraco.Cloud.Issues

Public issue tracker for Umbraco Cloud
24 stars 2 forks source link

Cache Everything option caches not published content when Umbraco Preview mode is active #724

Open Rosen-Petrov opened 5 months ago

Rosen-Petrov commented 5 months ago

Issue description

Hello,

This is a tricky one and is a huge problem for our client because it exposes content which is not published.

As part of performance optimizations we have enabled the "Cache Everything" option under the "CDN Caching and Optimization settings section". Recently after that we got a feedback that not published content gets visible on the site and after some troubleshooting we were able to reproduce the issue. Here are the steps:

  1. Our content editors use the live hostname to access the backoffice. (https://somelivehostname.com/umbraco)
  2. When they click the Preview button on a page, Umbraco enters a Preview mode and starts showing content which is not published. By itself this is not the issue.
  3. A content editor doesn't click on the "End Preview" button. This causes the browser to keep the "UmbracoPreview" cookie.
  4. When the Cloudflare cache expires and the first request to a page is from a content editor's browser which has the "UmbracoPreview" cookie, Umbraco detects that preview mode is active, not published content is pulled and cached by Cloudflare making it visible for all visitors.

I see that it is an edge case but it happens to us pretty often and I believe that some improvements should be done in the integration with Cloudflare so it doesn't cache when Umbraco is in Preview Mode.

This is actually an issue when you just use the default Dotnet OutputCache, as well, but there we have control to fix it by customizing the caching logic. I mention this because it might make sense to revisit the Preview functionality in Umbraco as a whole since it has this "weak" part where the "UmbracoPreview" cookie easily sticks and this causes issues with different HTML Output caching mechanisms.

For now, we made our clients to clear their cookies and use the default Umbraco Cloud URL for editing. But since this is not official recommendations or rule which Umbraco pushes so far, I decided to raise this ticket, so it gets addressed properly.

Kind regards Rosen

sajumb commented 5 months ago

Hello @Rosen-Petrov, Thank you for bringing this issue to our attention. Especially for outlining the steps and scenarios so clearly. Your insights have brought to light the challenges your clients face with the inadvertent visibility of unpublished content, stemming from the interaction between Umbraco's Preview mode, the UmbracoPreview cookie, and Cloudflare's "Cache Everything" setting.

We aim to address this issue in a manner that ensures both the performance and security of content managed through Umbraco Cloud.

Thank you again for your detailed report.