3 ms·
It's not permanent if you don't make it permanent - like the other cache-control headers, you can specify the amount of time that a resource is considered immut
by mmastrac 10y ago
It's not permanent if you don't make it permanent - like the other cache-control headers, you can specify the amount of time that a resource is considered immutable. All this does is change the time period in which the browser avoids sending 304s.
- Confiks 10y agoThis might be considered similar to the DoS vector that was also present in the HTTP Public Key Pinning proposal [1]; an adversary seizing temporary control over the server can convince clients to not request a response from the server for a certain period, or in the case of HPKP request a response that cannot possibly be fulfilled. Its seems much more mundane in this Cache-Control case, but it is the same vector nevertheless. [1] https://blog.qualys.com/ssllabs/2016/09/06/is-http-public-key-pinning-dead https://blog.qualys.com/ssllabs/2016/09/06/is-http-public-ke...