1348707 - Firefox ignores only-if-cached in requests

Status: UNCONFIRMED

(Core :: Networking: Cache, enhancement, P3)

Description

[Mark Nottingham]

If a request contains Cache-Control: only-if-cached, firefox ignores it; i.e., it will not generate a 504 response if there isn't a suitable response available.

Spec:
  http://httpwg.org/specs/rfc7234.html#rfc.section.5.2.1.7

Test:
  https://github.com/mnot/web-platform-tests/blob/http-cache/fetch/http-cache/cc-request.html

Comment 1

[Ben Kelly [:bkelly, not reviewing]]

I'm pretty sure `fetch(url, { cache: 'only-if-cached' })` works.  It is limited to same-origin requests, though.  I wonder if this behavior is intentional.

Comment 2

[Honza Bambas (:mayhemer)]

(In reply to Ben Kelly [not reviewing due to deadline][:bkelly] from comment #1)
> I'm pretty sure `fetch(url, { cache: 'only-if-cached' })` works.  It is
> limited to same-origin requests, though.  I wonder if this behavior is
> intentional.

Ben, Cache-control HTTP request header has nothing to do with fetch().  

Or is the report related to DOM cache?

Comment 3

[Ben Kelly [:bkelly, not reviewing]]

(In reply to Honza Bambas (:mayhemer) from comment #2)
> Ben, Cache-control HTTP request header has nothing to do with fetch().  
> 
> Or is the report related to DOM cache?

My point is we have the primitives to do it because fetch API is using them:

https://dxr.mozilla.org/mozilla-central/source/netwerk/protocol/http/HttpBaseChannel.cpp#2712

But the fetch API explicitly restricts this to same-origin requests to protect against cross-origin cache probing.

I was suggesting perhaps http cache purposely ignores Cache-Control:only-if-cached for the same cache probing privacy issue.

Comment 4

[Mark Nottingham]

(In reply to Ben Kelly [not reviewing due to deadline][:bkelly] from comment #3)
> I was suggesting perhaps http cache purposely ignores
> Cache-Control:only-if-cached for the same cache probing privacy issue.

I was wondering about that. I note that no browser currently supports only-if-cached in requests (although some don't support a lot of other CC request directives either).

If there is a legitimate privacy concern here, and there's agreement between the browsers about it, we could document (in fetch) that oic in requests should be ignored, or limited to same-origin requests.

Comment 5

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 6

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258