Cache-Control headers no longer interpreted properly in Chromium 93-CodePudding

Since around the start of this month (September 2021), the web application we're building has intermittently started to show error pages. We've tracked this down to issues related to HTTP response caching, but none of the changes we made in code around that time period contained changes related to it, so we suspect it's caused by the Chromium 93 update.

Are there any known issues with version 93 of Chromium?

CodePudding user response：

We managed to track this down - it is, in fact not an issue with Chromium, but a years-old issue in our own code that has gone unnoticed for a long while.

For specific cases, we add a caching header to HTTP responses as follows:

Cache-Control: max-age=0 must-revalidate

This does not follow the specifications for this particular header, which are.

Caching directives have the following rules to be valid:

Case-insensitive, but lowercase is recommended.

Multiple directives are comma-separated.

Some directives have an optional argument, which can be either a token or a quoted-string. (See spec for definitions)

In other words it's supposed to be a comma-separated list of directives, i.e.

Cache-Control: max-age=0, must-revalidate

This (correctly) broke due to an update to Chromium as expected. This changeset shows an update that makes Chromium much stricter when interpreting the Cache-Control header, which for our case in particular can be determined from the following (new!) unit test:

TEST_F(HttpResponseHeadersCacheControlTest, MaxAgeWithInterimSpaceIsRejected) {
  InitializeHeadersWithCacheControl("max-age=1 2");
  EXPECT_FALSE(headers()->GetMaxAgeValue(TimeDeltaPointer()));
}

So it seems the code originally was interpreted as

Cache-Control: max-age=0

But in recent versions of Chrome is now ignored completely.

Ensuring the Cache-Control header is comma-separated throughout our codebase resolved this issue.