Subject: Caching Problem with 1.0 and a Proxy Server

From: "Tim Coates" <[email-masked]>
Date: Wed, 8 Nov 2000 11:30:20 +1100

A small problem to overcome...

We already know the caching problems with 1.0 but....

Firstly, assume that no proxy server is used. A browser send a a request
using HTTP 1.1 protocol. The response it receives from the web server is
also HTTP 1.1. This can be proven viewing the logs provided by a packet
sniffer. The document received by the browser contains 1.1 header for cache
control. The cache control instructions basically force the brower to do a
get each time the user requests the page.

Now... add a proxy server. I had to modify the Windows registry so that the
browser would issue a 1.1 request to the web server (via the proxy). The
browser sends a 1.1 request, but receives a 1.0 response - this is from the
same web server, and I am using the same browser.

What appears to happen is that the proxy server downgrades the protocol
identifier (at least in the response back to the web browser) and forwards
the response containing the 1.1 cache control headers to the browser. The
browser now interprets the response using the 1.0 instructions and the end
result is that the page is caches. If I ask for the same page again (and not
using a forced GET) the page is retrieved from the cache as no GET request
is captured by the packet sniffer.

I have different browser that upon receipt of a response that indicates a
1.0 response, but contains 1.1 headers seems to disregard the protocol
identifier in the response and processes each header instruction received.
The end result is that even though the protocol identifier says it is 1.0,
when a GET is issued, the page is requested from the web server.

Note that in the example given above the same web page was requested, from
the same web server. We know that a proxy server downgrades the response,
but that affects the way the response is also handled by the browser.

Questions:

1. What meaning (other than the obvious) is attached to the protocol
identifier (e.g. HTTP/1.0) that is contained in a browser request or
response?

2. How strictly should a web browser use the protocol identifier in
processing a response from a web server?

Thanks,
Tim C.

---

From: Jeffrey Mogul <[email-masked]>
Date: Tue, 07 Nov 2000 17:40:12 -0800

See RFC 2145. "Use and Interpretation of HTTP Version Numbers",
     J. C. Mogul, R. Fielding, J. Gettys, H. Frystyk, May 1997. 

     HTTP request and response messages include an HTTP protocol
     version number. Some confusion exists concerning the proper use
     and interpretation of HTTP version numbers, and concerning
     interoperability of HTTP implementations of different protocol
     versions. This document is an attempt to clarify the situation.

Read it carefully, and your questions should be answered.  A
proxy that converts an HTTP/1.1 request message to an HTTP/1.0
request is almost certainly legal.  I would be more worried
(well, "pissed off" is more accurate) about an HTTP/1.0 proxy
that does NOT label its messages as HTTP/1.0.

Whenever an HTTP protocol header could be misinterpreted if
you are using the wrong version of the protocol spec, then
the browser should be very cautious about using it if the
version number seems to be inconsistent.  The HTTP/1.1 spec
(RFC 2616) documents a number of specific cases.

-Jeff