Cache-safety headers: mark auth-scoped responses private/no-store (#200) - #201
Merged
Conversation
Route, ResourceManifest and ComponentPosition responses are served from an identical URL but vary by the authenticated session, with no distinguishing URL or query marker for a shared cache to key on. Add CacheHeadersEventListener (kernel.response, POST_RESPOND): when the request is authenticated and the resource is in the affected set, override API Platform's default `public` with `Cache-Control: private, no-store`. Anonymous/unaffected responses stay publicly cacheable, so the only variant a shared cache stores is the published one - matching Souin's edge rule. `no-store` is the marker the module's service-worker cacheWillUpdate drops on (cwa-nuxt-module #258). - No Vary: Cookie (would collapse static cache-hit rate); existing Vary: path on dynamic positions untouched. - Affected set = configurable http_cache.personalised_resource_classes (default Route, ResourceManifest, ComponentPosition) plus any Publishable resource, matched dynamically. - Behat features/main/cache_headers.feature covers authed/anon per resource type and an unaffected type (Layout) staying public.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #201 +/- ##
============================================
- Coverage 26.29% 26.13% -0.17%
- Complexity 2514 2526 +12
============================================
Files 252 253 +1
Lines 7325 7370 +45
============================================
Hits 1926 1926
- Misses 5399 5444 +45
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #200.
Route, ResourceManifest and ComponentPosition responses are served from an identical URL but vary by the authenticated session, with no distinguishing URL or query marker a shared cache can key on. This makes that safety decision legible in the response itself.
CacheHeadersEventListener(kernel.response,POST_RESPOND): when the request is authenticated and the resource is in the affected set, override API Platform's defaultpublicwithCache-Control: private, no-store. Anonymous / unaffected responses stay publicly cacheable — so the only variant a shared cache stores is the published one, matching Souin's edge rule.no-storeis the marker the module's service-workercacheWillUpdatedrops on (components-web-app/cwa-nuxt-module#258).Decisions
Vary: Cookie— many cookies churn and it would collapse the static cache-hit rate. The existingVary: pathon dynamic positions is untouched.http_cache.personalised_resource_classes(defaultRoute,ResourceManifest,ComponentPosition), plus any Publishable resource matched dynamically. Unaffected types (e.g.Layout) stay public even when authenticated.Tests
features/main/cache_headers.feature— authed/anon per resource type + unaffectedLayoutstaying public (8 scenarios).