bneradt opened a new pull request, #13912: URL: https://github.com/apache/trafficserver/pull/13912
Since #12670, a Cache-Control directive followed by anything other than a numeric argument has been treated as malformed and ignored. That also caught the valid qualified forms of private and no-cache, such as private="X-User-Token" from RFC 9111. A response carrying private="X-User-Token", max-age=600 therefore lost its private restriction but kept its max-age, so ATS stored it in the shared cache and served one user's response, including the named field, to other users. Qualified no-cache responses were likewise served without revalidation. This patch accepts the RFC 9111 argument grammar, a token or a quoted-string, after non-numeric directives. A qualified private or no-cache is treated as its unqualified form, which is how ATS handled these directives before #12670. Unparseable content after a directive or its argument is still detected and ignored as before. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
