-
Notifications
You must be signed in to change notification settings - Fork 849
Description
Hi,
POST method request will delete existing cache with the same URL, i.e. anyone can flush the cache of any URL by simply sending a POST method request, that is not an expected behaviour, I believe.
This is the behaviour with the configuration where proxy.config.http.cache.post_method is 0 (the default value).
$ curl -v --output /dev/null http://cacheable.example.com/ |& grep age:
age: 0 <-- initial request, thus fresh response
$ curl -v --output /dev/null http://cacheable.example.com/ |& grep age:
age: 1 <-- cached response
$ curl -X POST -v --output /dev/null http://cacheable.example.com/ |& grep age:
age: 0 <-- fresh response, because POST is not cachable
$ curl -v --output /dev/null http://cacheable.example.com/ |& grep age:
age: 0 <-- fresh response, because the existing cache was deleted by POST request above
This is because is_method_cacheable is false for POST method request
| HttpTransactHeaders::is_method_cacheable(const HttpConfigParams *http_config_param, const int method) |
but
does_method_require_cache_copy_deletion is truetrafficserver/proxy/http/HttpTransact.cc
Line 666 in 3bb1ae9
| does_method_require_cache_copy_deletion(const HttpConfigParams *http_config_param, const int method) |
that is called in issue_revalidate where the existing cache will be deleted.
trafficserver/proxy/http/HttpTransact.cc
Line 2419 in 3bb1ae9
| if (does_method_require_cache_copy_deletion(s->http_config_param, s->method)) { |
(does_method_require_cache_copy_deletion is also used in HandleCacheOpenReadMiss, where it just does CACHE_DO_NO_ACTION.)
trafficserver/proxy/http/HttpTransact.cc
Line 3262 in 3bb1ae9
| if (does_method_require_cache_copy_deletion(s->http_config_param, s->method) && s->api_req_cacheable == false) { |
For now I am not sure what is the right way to fix this issue. does_method_require_cache_copy_deletion should exclude cases where is_method_cacheable is true ? Or issue_revalidate should delete cache only when both is_method_cacheable and does_method_require_cache_copy_deletion are true ?
Thanks in advance !
Kazuhiko