Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dropping Authorization from graphql hash #470

Merged
merged 2 commits into from
Aug 4, 2021

Conversation

pdohogne-magento
Copy link
Contributor

@pdohogne-magento pdohogne-magento commented Aug 2, 2021

This code is in the framework code for the hash subroutine:

  if( req.url ) {
    set req.hash += req.url;
    set req.hash += req.http.Host;
    set req.hash += req.http.Authorization;
    set req.hash += req.http.Fastly-SSL;
    set req.hash += req.vcl.generation;
    return (hash);
  }

However, req.http.Authorization being included in the hash means that every single user will get a different request id, which is not desired; the cache should be shared between users.

To fix this, this PR takes that same block but omits the Authorization header and returns before the Fastly-side code runs.

@pdohogne-magento
Copy link
Contributor Author

@vvuksan Please take a look at this PR and offer your thoughts. We've also pinged you in the Magento Community slack.

@vvuksan
Copy link
Contributor

vvuksan commented Aug 4, 2021

This workaround addresses a deficiency that was introduced in a vendor's tooling that added Authorization header to the cache key resulting in GraphQL queries not to cache efficiently. This change forces the cache key only for GraphQL paths.

@vvuksan vvuksan merged commit 45324c0 into fastly:master Aug 4, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants