cache-control mess in the headers and posible leak of secure
-
I have noted that sometimes some pages that are in the list “URLs to exclude from caching” comes from browser cache (Chrome 109).
I spent a few days to investigate the problem and found:
1) When WPO is deactivated all comes (to pages) from wp_include/function.php (wp_get_nocache_headers)
Cache-Control: no-cache, must-revalidate, max-age=0
Expires: Wed, 11 Jan 1984 05:00:00 GMT
That is neutral to caching (no cache but is not secure from storing some cache is browser)
2) When WPO is just activated but any caching is off it adds cache-control: private, must-revalidate to .htaccess file (it seams that mod_headers.c replace only the records that have been added by it) and since that all pages have 2 cache-control records in their headers (another cache-control: no-cache, must-revalidate, max-age=0 comes from WP core (see #1)), that according to Apache documentation “can lead to unforeseen consequences”(https://httpd.apache.org/docs/2.4/mod/mod_headers.html#header)
So, when WPO is just activated it already create the problem!
3) When WPO is active and caching it adds cache-control: no-cache that replace that one, that comes from WP core (see #1) but with that one, that comes from .htaccess are still creates 2 cache-control records in header.
4) But the real problem happens with pages that marked to be excluded from caching. Including them in the list “URLs to exclude from caching” we clear understand that we are doing our best to avoid them to be cached. So we expect to find in the header something like:
cache-control: no-cache, no-store, max-age=0
and no expires record
But there are:
cache-control: private, must-revalidate (comes from .htaccess file (see #2)
expares: in future
It means that such pages are stored by browser and can be shown later and even to someone else.
It definitely should be added “no-store” to Cache-Control (as well as no-cache, max-age=0 and expires should be removed for such “exclude from cache” pages to prevent known leak of security (one of them described by chrome team here: https://github.com/fergald/explainer-bfcache-ccns/blob/main/README.md )
I know that the question either use “no-store” or not is discussable and on https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching baselessly climes not to use it, but all real browser use it as it assumed can be used
https://web.dev/http-cache/#cache-control
5) A bit more errors with “URLs to exclude from caching”:
I input there:
=========
/tests/*
/yandexinfo.php
/regsem/*
========
where /regsem/ is a page and it doesn’t cache,
/yandexinfo.php is a page and it doesn’t cache,
BUT /tests/* is the 1st level of structure and it caches (but the next levels are not.
https://forcesail.ru/tests/ (cached)
https://forcesail.ru/tests/basic-movements/ (not cached)
6) It’s probably incorrect that you WPO ignores nocache_headers WP core hook to synchronize header’s recording with WP and other plugin and adds headers directly. I haven’t investigated that it comes to any errors now but it’s breaking of structure and is a posible way to serious problems in any future.
- The topic ‘cache-control mess in the headers and posible leak of secure’ is closed to new replies.
