Browse Source

[backend/file-browser] Force cache validation for file download

In the files-download, we were always setting the 'Last-Modified' header
for the downloaded files. Since, we were not providing the expiration,
the browser was not being forced to verify for a new versions and are
free to use their own heuristics. See the Caching RFC for more details
https://www.rfc-editor.org/rfc/rfc7234#section-4.2.2

This commit adds the 'Cache-Control: no-cache' header to force browsers
to validate the modified timestamp of the file before reusing the file
from cache.

Steps to reproduce (not reproducible every time):
1. Upload a file using the file browser.
2. Leave it for a few hours. Waiting is important as the heuristics for
    default expiry is dependent on the age of the file itself.
3. Open the JavaScript console.
4. Download the file. It should come with status 200
5. Quickly delete the file and upload another one with the same name.
6. Download the file with same name multiple times, while monitoring the
   response status code.
4. Some of the downloads will come from the cached version.

Steps to verify:
1. Follow the steps 1-3 above
2. The browser should use the cache version only as long as the file
   is not modified on the server.
Amit Srivastava 2 years ago
parent
commit
53257779fc
1 changed files with 1 additions and 0 deletions
  1. 1 0
      apps/filebrowser/src/filebrowser/views.py

+ 1 - 0
apps/filebrowser/src/filebrowser/views.py

@@ -203,6 +203,7 @@ def download(request, path):
     setattr(response, 'redirect_override', True)
   else:
     response = StreamingHttpResponse(file_reader(fh), content_type=content_type)
+    response["Cache-Control"] = 'no-cache' # Browsers must not cache files but always download
     response["Last-Modified"] = http_date(stats['mtime'])
     response["Content-Length"] = stats['size']
     response['Content-Disposition'] = request.GET.get('disposition', 'attachment; filename="' + stats['name'] + '"') \