Re: HTTP Expire Header for /check/referer

* Nick Kew wrote:
>As a point that may be of more academic than practical relevance,
>the correct behaviour of /check/referer would be not to mess about
>with Expires headers, nor even to restrict cacheing with cache-control,
>but to make it clear that content negotiation is happening based
>on the HTTP Referer header.  In other words, it should include
>"Referer" in a Vary: response header.

This is not sufficient. Freshness of the Validator result depends on the
freshness of the resource beeing validated and additionally the 'Vary'
header is new in HTTP/1.1. There are still lots of clients and proxies
out there, that do not support HTTP/1.1 and especially not the 'Vary'
header, for this reason Apache's mod_negotiate adds an Expires header to
responses to HTTP/1.0 requests (some time between 0 and 60 seconds in
the future). /check/refer should do something like

  if (response had pragma / cache-control / expires)
    add those headers
  else if (request was HTTP/1.0)
    add expires: <now>

  add vary: referer

regards.