Make request cacheable when it has "no-cache" header

Question

Make request cacheable when it has "no-cache" header

beltoev opened this issue 7 years ago · 4 comments

Why do we trust the client?

For example, "no-cache" header can be used for the ddos attacks. Besides OutputCacheAttribute (ASP.NET MVC 5) doesn't pay attention to this header.

Can we change the behavior of the attribute or add it to the settings?

GokGokalp commented 7 years ago

Any news?

Answer 1 · 2017-06-08T05:00:57.000Z

Yes, this is a basic design question we haven't reconciled yet. The cache was built as a real HTTP cache (that honors client headers), not an output cache (that is only beholden to the server). The only additional feature it has is VaryByQueryKeys.

We either need to pivot the whole component to become a true output cache, or to provide a separate middleware that fulfills that role.

@glennc

Answer 2 · 2017-11-13T19:06:31.000Z

We have not prioritized this work item for the next release. I'm putting this in backlog for now but @muratg may decide to move it out if he disagrees.

Answer 3 · 2018-01-02T01:02:16.000Z

This issue was moved to dotnet/aspnetcore#2607