dxbjavid opened a new pull request, #874: URL: https://github.com/apache/httpcomponents-client/pull/874
A shared cache must not store a response to a request that carried an Authorization header unless the response permits it through s-maxage, must-revalidate or public (RFC 9111 3.5). The guard treats any s-maxage as qualifying, but a malformed value like s-maxage=foo is parsed as 0 rather than -1, so it looks present and the authenticated response is stored in the shared cache and can later be handed to other clients on a revalidated hit. This tracks whether a valid s-maxage was actually supplied and uses that in the check, so a malformed directive is treated as absent as the spec requires; the numeric value is left unchanged so freshness behaviour is not affected. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
