Set Cache-Control to no-store on paths containing %2F/%5C/%2E - #2018
svpernova09 wants to merge 1 commit into
Conversation
|
📊 Regression report for commit 5384982 is at https://web-php-regression-report-pr-2018.preview.thephp.foundation |
|
🚀 Preview for commit 5384982 is available at https://web-php-pr-2018.preview.thephp.foundation |
| header('Cache-Control: no-store'); | ||
| }); | ||
| } | ||
| })(); |
There was a problem hiding this comment.
I don't understand why there is a closure here that you then need to execute immediately, nor why the header_register is there, considering that literally the next line in the code also sets a header.
There was a problem hiding this comment.
It was an attempt at encapsulation, and I went a bit overboard.
We shouldn't need this change if Bunny resolves the issue on their side. According to the support ticket, they've escalated it on their side, so this PR can wait until we see the outcome before moving forward.
3 participants
We currently have a CDN issue that can poison our caches because of how the CDN creates cache keys from paths, resulting in
/onwww.php.netbeing cached as a redirect.This patch catches those requests and sets
Cache-Control: no-storeheader so they won't be cached, but other legitimate redirects or 404s will be.Once this lands and is tested, we can remove the current workaround edge rules, which set cache time to 0 on all 301, 302, and 404 response codes.
I have opened a support ticket with Bunny to address the issue.