4 ms·
I always thought 404 responses would occupy trivial amount of memory on cache since they don't have a body. Ok, there is some overhead which might cause issues
by reader_1000 11y ago
I always thought 404 responses would occupy trivial amount of memory on cache since they don't have a body. Ok, there is some overhead which might cause issues if there is too much 404. However, I think some guy who is trying to crawl all of your web site is a bigger problem if your web site is big. You can throttle him based on his IP and user agent but how do you differiante people who has same IP because they are behing a cooparete proxy?
I also thought cache poisoning means putting a bad response into a cache by sending a special request so that innocent people will be served malicious response because they hit the cache. I think article uses it in a different context.
- StavrosK 11y agoWhen was the last time you saw a 404 without a body?
- reader_1000 11y agoWell, you are right, for most sites 404 returns a friendly error page. However for our case, it is a lot smaller page compared to 200 responses.
- cbsmith 11y agoThere's also the small matter that the pages tend to be "oddly" consistent.
- cperciva 11y agoI also thought cache poisoning means putting a bad response into a cache... I agree. The cached responses mentioned in this article are perfectly valid; they're simply not very useful. Rather than cache poisoning, I'd call this cache constipation.
- jacquesm 11y agoI can't imagine PHK making such a basic mistake, who wrote the post?
- cperciva 11y agoThe HTML header says <meta name="author" content="Dridi Boukelmoune"> who according to crunchbase is a "Technical Presales Engineer" at Varnish.
- dridi 11y agoSorry for not misunderstanding. I'm not saying that PHK made a mistake, he picked the simple solution (which is very often the case). But LRU being too simple, you need to do more to fight again cache pollution. Segmenting your storage is the solution I suggest in the blog post.
- dridi 11y agoLet's call that cache pollution or flooding attacks. In the end, I consider it poisonous because I don't want to evict relevant content for junk (especially from the long tail). I do mention that the RFC says that 404 responses can be cached, and that according to my own cache policy, I disagree. It depends on your goals.