Question

请考虑以下情况：

我有RESTful URL /文章，可以返回文章列表
用户使用每个请求上的授权HTTP标头提供其凭据
根据用户的特权，文章可能因用户而异[/ li>

在这种情况下，可以像Squid一样使用缓存代理吗？代理只会看到URL /文章，因此它可能会返回仅对生成缓存的第一个用户有效的文章列表。请求URL /文章的其他用户可以看到他们无权访问的文章，当然这是不可取的。

我应该滚动自己的缓存还是可以配置一些缓存代理软件以将其缓存基于授权HTTP标头？

Answer 1

尝试的一种可能性是使用Vary: Authorization响应标头指示下游缓存通过根据请求的Authorization标头更改缓存文档来注意缓存。

如果使用响应压缩，则可能已在使用此标头。用户通常请求具有标题Accept-Encoding: gzip, deflate的资源;如果服务器配置为支持压缩，则响应可能会随标题Content-Encoding: gzip和Vary: Accept-Encoding一起提供。

Answer 2

通过HTTP / 1.1 RFC第14.8节（http://tools.ietf.org/html/rfc2616#section-14.8）：

  When a shared cache (see section 13.7) receives a request
  containing an Authorization field, it MUST NOT return the
  corresponding response as a reply to any other request, unless one
  of the following specific exceptions holds:

  1. If the response includes the "s-maxage" cache-control
     directive, the cache MAY use that response in replying to a
     subsequent request. But (if the specified maximum age has
     passed) a proxy cache MUST first revalidate it with the origin
     server, using the request-headers from the new request to allow
     the origin server to authenticate the new request. (This is the
     defined behavior for s-maxage.) If the response includes "s-
     maxage=0", the proxy MUST always revalidate it before re-using
     it.

  2. If the response includes the "must-revalidate" cache-control
     directive, the cache MAY use that response in replying to a
     subsequent request. But if the response is stale, all caches
     MUST first revalidate it with the origin server, using the
     request-headers from the new request to allow the origin server
     to authenticate the new request.

  3. If the response includes the "public" cache-control directive,
     it MAY be returned in reply to any subsequent request.

使用经过身份验证的REST请求缓存代理

2 个答案: