[jira] [Resolved] (HTTPCLIENT-1384) Expose CacheInvalidator in CachingHttpClientBuilder

["Oleg Kalnichevski (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/HTTPCLIENT-1384?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Oleg Kalnichevski resolved HTTPCLIENT-1384.
-------------------------------------------
    Resolution: Fixed

@[~nricheton] {{#flushCacheEntriesFor}} and {{#flushInvalidatedCacheEntriesFor}} appear to be serving completely different purposes and applicable to different phases in request execution sequence. I am not sure they should be collapsed into a single method. I tried to make the distinction clearer by giving the methods better names. Please have a look at the new 5.0 APIs and raise a follow-up issue if you would like any changes to be made to the new cache invalidation APIs.

Oleg

> Expose CacheInvalidator in CachingHttpClientBuilder
> ---------------------------------------------------
>
>                 Key: HTTPCLIENT-1384
>                 URL: https://issues.apache.org/jira/browse/HTTPCLIENT-1384
>             Project: HttpComponents HttpClient
>          Issue Type: Wish
>          Components: HttpCache
>    Affects Versions: 4.3 Final
>            Reporter: Nicolas Richeton
>            Assignee: Oleg Kalnichevski
>              Labels: stuck, volunteers-wanted
>             Fix For: 5.0 Beta1
>
>         Attachments: httpclient-patch.txt, patch.txt
>
>
> There is currently no way to customize the CacheInvalidator. Could it be possible to allow setting a  CacheInvalidator in CachingHttpClientBuilder (eg. CachingHttpClientBuilder#setCacheInvalidator())
> Our use case : 
> - HttpClientCache is used in a Caching Reverse Proxy (shared cache, exposed to public connections)
> - We have to ensure the cache cannot be flush by a random user.  
> - The default CacheInvalidator flushes all variants of an URI when receiving anything other than GET, HEAD (compliant with RFC)
> - It is currently possible for a user to flush the whole cache by sending POST requests of all uri (this may be harmful even only on a home page). 
> While it is not RFC-compliant, we need at least the ability to prevent invalidation in CacheInvalidator#flushInvalidatedCacheEntriesFor and/or control invalidation with custom method  (PURGE) and other criteria (like remote ip)
> The same applies to HttpClientCache 4.2.5: CachingHttpClient which does not allow provide a custom CacheInvalidator
> Would this sound ok for you ? 



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org