-
-
Notifications
You must be signed in to change notification settings - Fork 2k
Open
Description
Bug Description
The hasDirective function in the cache middleware only recognizes a directive when it's followed by a comma (,) or end-of-string. It does not account for directives followed by a space, tab, or = (for directives with arguments).
This means headers like:
Pragma: no-cache(trailing space) —no-cacheis not detectedCache-Control: private(trailing space) —privateis not detectedCache-Control: no-cache="Set-Cookie"—no-cacheis not detected
This can cause the cache middleware to serve cached responses when it shouldn't (e.g., a private response could leak into the shared cache, or a no-cache Pragma hint could be ignored).
How to Reproduce
// These all incorrectly return false:
hasDirective("no-cache ", "no-cache") // trailing space → false (should be true)
hasDirective("no-cache\t", "no-cache") // trailing tab → false (should be true)
hasDirective(`no-cache="Set-Cookie"`, "no-cache") // directive with value → false (should be true)
hasDirective("private ", "private") // trailing space → false (should be true)Expected Behavior
hasDirective should recognize a directive as matched when it is followed by end-of-string, ,, , \t, or =, since all of these are valid terminators for a Cache-Control directive token per RFC 9111.
Fiber Version
v3 (main)
Checklist:
- I agree to follow Fiber's Code of Conduct.
- I have checked for existing issues that describe my problem prior to opening this one.
- I understand that improperly formatted bug reports may be closed without explanation.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Type
Projects
Status
No status