Re: CORS and Caching (in reverse proxies / CDNs)

On 30/04/14 16:04, Anne van Kesteren wrote:
> On Wed, Apr 30, 2014 at 2:56 PM, Nils Goroll <slink@schokola.de> wrote:
>> On 30/04/14 14:47, Anne van Kesteren wrote:
>>> It is. You could terminate the request if the Origin request header
>>> was not "correct".
>>
>> How should this work with CDNs and downstream caches?
> 
> Whether downstream caches have a copy seems like enough of a headache
> for developers to not link your font inappropriately. It might
> sometimes work, and sometimes not.

I'd say this completely misses the point. The point I have brought up is a
general one, not one about developers' brains.

Once you deliver an object with "Access-Control-Allow-Origin: *" and
Cache-Control headers which allow for downstream caching, subsequent requests to
 intermediates will be fulfilled by those and the object will be delivered with
"Access-Control-Allow-Origin: *" no matter what the Origin request header was.

The logic you are proposing simply cannot be implemented on downstream caches,
and will be hard to implement on many CDNs.

>>> If we were to do this at this point we probably have to introduce a
>>> new header or force everyone to sniff user agents for support.
>>> However, there haven't been many requests for it.
>>
>> I don't understand how sniffing user-agents relates to this issue.
> 
> If we introduce new syntax it would break older clients (they would
> not get anything).

If you were to propose user-agent sniffing on the server-side, this implied to
add "Vary: User-Agent" to the response - which would, due to the high variation
of User-Agent strings, kill any caching. So this is absolutely no option to
address the issue I have brought up - which is about a less significant caching
issues.


What about this:

http://www.w3.org/TR/cors/#access-control-allow-origin-response-header

 In practice the origin-list-or-null production is more constrained.
 Rather than allowing a space-separated list of origins, it is either a
 single origin or the string "null".

Why has this note been added? If we could force implementors to follow the
actual ABNF

 Access-Control-Allow-Origin = "Access-Control-Allow-Origin" ":"
origin-list-or-null | "*"

this issue would vanish for many real world cases.

Nils

Received on Wednesday, 30 April 2014 14:54:43 UTC