Aias00 opened a new issue, #6506: URL: https://github.com/apache/shenyu/issues/6506
### Search before asking - [x] I had searched in the [issues](https://github.com/apache/shenyu/issues) and found no similar issues. ### Apache ShenYu Component shenyu-plugin ### What happened `CacheUtils.dataKey(...)` builds the cache key only from query string and raw path: ```java public static String dataKey(final ServerWebExchange exchange) { URI uri = exchange.getRequest().getURI(); return DigestUtils.md5Hex(String.join(KEY_JOIN_RULE, uri.getQuery(), uri.getRawPath())); } ``` The HTTP method, request body, and other request-varying inputs are not included. The cache plugin itself does not restrict caching to idempotent `GET` requests. As a result, different requests to the same path/query can reuse the same cache entry. For example, these requests share the same cache key even though they can produce different upstream responses: ```text POST /orders/quote {"sku":"A","quantity":1} ``` ```text POST /orders/quote {"sku":"B","quantity":1} ``` The second request can receive the first request's cached body. ### Expected behavior Cache keys should include the dimensions that affect the upstream response, or the plugin should clearly restrict and validate cache usage to request shapes where path/query is sufficient. At minimum, the HTTP method should be part of the key, and body-sensitive methods should either include a body hash or be rejected unless a configured cache-key expression is provided. ### How to reproduce 1. Enable the cache plugin for an endpoint that accepts `POST` requests. 2. Send a `POST` request to `/orders/quote` with one body and let it be cached. 3. Send another `POST` request to the same path/query but with a different body. 4. The second request uses the same `CacheUtils.dataKey(...)` value and can receive the first response from cache. ### Debug logs _No response_ ### Environment Current `master` branch. ### Are you willing to submit a PR? - [ ] Yes I am willing to submit a PR! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
