Skip to content

POST method request will delete existing cache #7839

@fdiary

Description

@fdiary

Hi,

POST method request will delete existing cache with the same URL, i.e. anyone can flush the cache of any URL by simply sending a POST method request, that is not an expected behaviour, I believe.

This is the behaviour with the configuration where proxy.config.http.cache.post_method is 0 (the default value).

$ curl -v --output /dev/null http://cacheable.example.com/ |& grep age:
age: 0 <-- initial request, thus fresh response
$ curl -v --output /dev/null http://cacheable.example.com/ |& grep age:
age: 1 <-- cached response
$ curl -X POST -v --output /dev/null http://cacheable.example.com/ |& grep age:
age: 0 <-- fresh response, because POST is not cachable
$ curl -v --output /dev/null http://cacheable.example.com/ |& grep age:
age: 0 <-- fresh response, because the existing cache was deleted by POST request above

This is because is_method_cacheable is false for POST method request

HttpTransactHeaders::is_method_cacheable(const HttpConfigParams *http_config_param, const int method)

but does_method_require_cache_copy_deletion is true
does_method_require_cache_copy_deletion(const HttpConfigParams *http_config_param, const int method)

that is called in issue_revalidate where the existing cache will be deleted.

if (does_method_require_cache_copy_deletion(s->http_config_param, s->method)) {

(does_method_require_cache_copy_deletion is also used in HandleCacheOpenReadMiss, where it just does CACHE_DO_NO_ACTION.)

if (does_method_require_cache_copy_deletion(s->http_config_param, s->method) && s->api_req_cacheable == false) {

For now I am not sure what is the right way to fix this issue. does_method_require_cache_copy_deletion should exclude cases where is_method_cacheable is true ? Or issue_revalidate should delete cache only when both is_method_cacheable and does_method_require_cache_copy_deletion are true ?

Thanks in advance !

Kazuhiko

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions