25

考虑以下场景：

  • 我有返回文章列表的 RESTful URL /articles
  • 用户在每个请求上使用 Authorization HTTP 标头提供他的凭据
  • 根据用户的权限，文章可能因用户而异

在这种情况下是否可以使用缓存代理，如 Squid？代理将只看到 URL /articles，因此它可能会返回仅对生成缓存的第一个用户有效的文章列表。其他请求 URL /articles 的用户可以看到他们无权访问的文章，这当然是不可取的。

我应该滚动自己的缓存还是可以将某些缓存代理软件配置为基于 Authorization HTTP 标头的缓存？

4

2 回答 2

29

一种尝试的可能性是使用Vary: Authorization响应头来指示下游缓存通过根据请求的Authorization头改变缓存的文档来小心缓存。

如果您使用响应压缩，您可能已经在使用此标头。用户通常请求带有 header 的资源Accept-Encoding: gzip, deflate；如果服务器配置为支持压缩，则响应可能已经带有标Content-Encoding: gzip头Vary: Accept-Encoding。

于 2009-11-09T13:48:06.913 回答
11

通过 HTTP/1.1 RFC 第 14.8 节（https://www.rfc-editor.org/rfc/rfc2616#section-14.8）：

  When a shared cache (see section 13.7) receives a request
  containing an Authorization field, it MUST NOT return the
  corresponding response as a reply to any other request, unless one
  of the following specific exceptions holds:

  1. If the response includes the "s-maxage" cache-control
     directive, the cache MAY use that response in replying to a
     subsequent request. But (if the specified maximum age has
     passed) a proxy cache MUST first revalidate it with the origin
     server, using the request-headers from the new request to allow
     the origin server to authenticate the new request. (This is the
     defined behavior for s-maxage.) If the response includes "s-
     maxage=0", the proxy MUST always revalidate it before re-using
     it.

  2. If the response includes the "must-revalidate" cache-control
     directive, the cache MAY use that response in replying to a
     subsequent request. But if the response is stale, all caches
     MUST first revalidate it with the origin server, using the
     request-headers from the new request to allow the origin server
     to authenticate the new request.

  3. If the response includes the "public" cache-control directive,
     it MAY be returned in reply to any subsequent request.
于 2014-08-26T08:50:08.887 回答