Skip to content

🐛 [Bug]: Cache middleware hasDirective misses directives followed by space, tab, or '=' #4143

@mango766

Description

@mango766

Bug Description

The hasDirective function in the cache middleware only recognizes a directive when it's followed by a comma (,) or end-of-string. It does not account for directives followed by a space, tab, or = (for directives with arguments).

This means headers like:

  • Pragma: no-cache (trailing space) — no-cache is not detected
  • Cache-Control: private (trailing space) — private is not detected
  • Cache-Control: no-cache="Set-Cookie"no-cache is not detected

This can cause the cache middleware to serve cached responses when it shouldn't (e.g., a private response could leak into the shared cache, or a no-cache Pragma hint could be ignored).

How to Reproduce

// These all incorrectly return false:
hasDirective("no-cache ", "no-cache")             // trailing space → false (should be true)
hasDirective("no-cache\t", "no-cache")            // trailing tab → false (should be true)
hasDirective(`no-cache="Set-Cookie"`, "no-cache") // directive with value → false (should be true)
hasDirective("private ", "private")               // trailing space → false (should be true)

Expected Behavior

hasDirective should recognize a directive as matched when it is followed by end-of-string, ,, , \t, or =, since all of these are valid terminators for a Cache-Control directive token per RFC 9111.

Fiber Version

v3 (main)

Checklist:

  • I agree to follow Fiber's Code of Conduct.
  • I have checked for existing issues that describe my problem prior to opening this one.
  • I understand that improperly formatted bug reports may be closed without explanation.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Status

    No status

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions