https://bz.apache.org/bugzilla/show_bug.cgi?id=70161
Bug ID: 70161
Summary: mod_expires is fundamentally flawed: server
unilaterally predicts file lifetimes
Product: Apache httpd-2
Version: 2.4.58
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: mod_expires
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
mod_expires adds Expires headers to HTTP responses based on server-side rules.
The core assumption is that the server can predict how long a file will remain
valid.
This assumption is wrong. The server has no way to know when a file will
change. A CSS file edited at 3am has an Expires set to "1 month from now" — the
server is making a guess about the future.
# Apache config
ExpiresActive On
ExpiresDefault "access plus 1 month"
# Result: every response gets
Expires: Wed, 27 Aug 2026 03:08:42 GMT
Why this is a problem:
- Contradictory headers. mod_expires does not check for existing Cache-Control.
If mod_headers sets Cache-Control: no-cache, Apache sends both no-cache and
Expires: +1 month — mutually exclusive directives.
- HTTP/1.0 clients obey Expires. Proxies, old crawlers, and some CDNs respect
Expires and serve stale content.
- No opt-out per route. You must use ExpiresActive Off per LocationMatch to
prevent bad headers — which is fragile and verbose.
- Wrong default. ExpiresDefault "access plus 1 month" is applied to ALL content
types, including HTML, JSON, and dynamically generated files.
What to use instead:
Cache-Control and FileETag already cover all caching scenarios with explicit,
per-resource directives:
- Cache-Control: no-cache + FileETag MTime Size — files that may change (CSS,
JS). Browser revalidates every time.
- Cache-Control: no-store — dynamic content (API, HTML pages). No caching at
all.
No guessing. No predictions. Explicit semantics per resource.
Environment: Apache/2.4.58 (Ubuntu), mod_expires + mod_headers
Workaround: Disable mod_expires entirely (a2dismod expires). Use Cache-Control
+ FileETag instead.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
