[5.x] Fix: Prevent 304 responses without client cache headers#13654
Merged
jasonvarga merged 1 commit intostatamic:5.xfrom Jan 22, 2026
Merged
[5.x] Fix: Prevent 304 responses without client cache headers#13654jasonvarga merged 1 commit intostatamic:5.xfrom
jasonvarga merged 1 commit intostatamic:5.xfrom
Conversation
Fixes #13652 The static caching middleware was unconditionally calling isNotModified() on every cached response, which could incorrectly return HTTP 304 to clients that didn't send cache validation headers (If-None-Match or If-Modified-Since). This caused browsers like Safari to download 0-byte files instead of rendering pages. Root cause: - ApplicationCacher may cache responses with ETag/Last-Modified headers from previous requests - When serving cached responses, these stale headers interfere with fresh ETag generation - isNotModified() evaluates these cached headers and incorrectly returns true even without client validation headers Solution: 1. Clear any stale ETag/Last-Modified headers before setting fresh ETag 2. Only call isNotModified() when request contains cache validation headers (If-None-Match or If-Modified-Since) This preserves ETag functionality for legitimate conditional requests while preventing inappropriate 304 responses. Tested: - Request without cache headers → 200 OK ✓ - Request with If-None-Match → 304 Not Modified ✓
mynetx
changed the title
Member
|
Thank you |
This was referenced Feb 10, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #13652
Problem
The static caching middleware was unconditionally calling
isNotModified()on every cached response, which could incorrectly return HTTP 304 to clients that didn't send cache validation headers (If-None-MatchorIf-Modified-Since). This caused browsers like Safari to download 0-byte files instead of rendering pages.Root Cause
ApplicationCachermay cache responses withETag/Last-Modifiedheaders from previous requestsisNotModified()evaluates these cached headers and incorrectly returns true even without client validation headersSolution
This PR updates
src/StaticCaching/Middleware/Cache.phpto:ETag/Last-Modifiedheaders before setting a fresh ETagisNotModified()when the request contains cache validation headers (If-None-MatchorIf-Modified-Since)This preserves ETag functionality for legitimate conditional requests while preventing inappropriate 304 responses.
Testing
If-None-Match→ HTTP 304 Not Modified (ETag functionality preserved)Related
This is related to the ETag support feature introduced in v5.68 (PR #11441), which has had one previous bug fix in v5.70 (#13425).