Subject: #403: cacheability of Authentication and no-cache

From: Mark Nottingham <[email-masked]>
Date: Thu, 15 Nov 2012 16:50:16 +1100

Hi Amos,

I've created that as <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/403>.

My .02 -- I seem to remember some discussion about this. While it's true that revalidation is necessary to make an authenticated, cached response work properly, it doesn't follow that every condition that would lead to mandatory revalidation is a signal from the origin server that it's OK to cache the response to an authenticated request. "no-cache" is a particularly poor example of such a signal, since it's often misunderstood.

IIRC this is why we left no-cache out.

While we're here -- I'd like to remove all of the caching information from p7 and replace it with a reference to p6 3.2. Make sense?

On 14/10/2012, at 2:36 PM, Amos Jeffries <[email-masked]> wrote:

> While reviewing the clauses for cacheability I find an undefined case which can reasonably be expected to appear in real-world traffic.
> 
> Comparing p6 section 7.2.2.3 and 7.2.2.5 it is clear that response Cache-Control "no-cache" with no values is semantically equivalent to "must-revalidate, max-age=0".
> 
> p7 section 4.1 clause 2 states that responses with "must-revalidate" MAY be cached for use on later requests provided revalidation is done.
> 
> Assuming that p7 clause is true, I see no reason why "no-cache" response control cannot be also added to p7 section 4.1 list of exceptions along with must-revalidate.
> 
> Amos
> 
> 

--
Mark Nottingham   http://www.mnot.net/

---

From: Julian Reschke <[email-masked]>
Date: Thu, 15 Nov 2012 08:30:05 +0100

On 2012-11-15 06:50, Mark Nottingham wrote:
> ...
> ...

Absolutely.

---

From: Amos Jeffries <[email-masked]>
Date: Thu, 15 Nov 2012 23:58:37 +1300

> IIRC this is why we left no-cache out.

I'm not quite sure I follow that. You left no-cache out of the list 
because it would be hard to explain rather than its semantics were wrong 
for the job?
  Or can anyone point me at a use case where no-cache would cause the 
wrong behaviour when storing an authenticated response?

> While we're here -- I'd like to remove all of the caching information from p7 and replace it with a reference to p6 3.2. Make sense?

Yes.

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 16 Nov 2012 09:23:05 +1100

On 15/11/2012, at 9:58 PM, Amos Jeffries <[email-masked]> wrote:

> I'm not quite sure I follow that. You left no-cache out of the list because it would be hard to explain rather than its semantics were wrong for the job?
> Or can anyone point me at a use case where no-cache would cause the wrong behaviour when storing an authenticated response?

It's easy enough to explain; we'd just add it to the list. The issue IIRC is that the other directives have always been an explicit signal from the origin that it's OK to store an authenticated response; no-cache has never explicitly been that signal, even though its behaviour may be similar. Changing that signal retroactively may have surprising effects for some who didn't intend it to be interpreted that way.

Cheers,

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 27 Nov 2012 14:15:11 +1100

I've removed the caching-specific language from p7 and replaced it with a reference to p6.

Amos, I think we can close the issue now; please speak up if you have more information.

Cheers,

---

From: Amos Jeffries <[email-masked]>
Date: Tue, 27 Nov 2012 22:06:08 +1300

> Amos, I think we can close the issue now; please speak up if you have more information.

I would just like to know what the new text looks like to see how the 
clauses hold together now.
(no patch in that bug ticket AFAICS and -21 is not guideline on what you 
changed)

Amos

---

From: Julian Reschke <[email-masked]>
Date: Tue, 27 Nov 2012 11:03:01 +0100

> (no patch in that bug ticket AFAICS and -21 is not guideline on what you

See <http://trac.tools.ietf.org/wg/httpbis/trac/changeset/1999#file1> 
and 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p7-auth-latest-from-previous.diff.html>.

Best regards, Julian

---

From: Amos Jeffries <[email-masked]>
Date: Tue, 27 Nov 2012 23:42:18 +1300

> <http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p7-auth-latest-from-previous.diff.html>.

Thank you.

My original request to get no-cache listed is not actioned. Bit sad, but 
okay.

proxy-revalidate may also be desirable adding to the p6 section 3.2 
list. It would need a disclaimer that it only allows caching 
Authenticated requests on shared caches though.

Amos