与验证的REST缓存代理请求

Question

考虑以下情形：

• 我有REST风格的URL /文章，返回文章列表
• 用户使用上的每个请求
• 文章可能会有所不同授权HTTP标头提供了国书从用户到用户根据他的权限

它可能使用高速缓存代理，如Squid，在这种情况下？ 代理将只能看到URL /文章，因此它可能会返回仅对生成缓存的第一个用户有效的文章列表。其他请求URL /文章的用户可以看到他们无法访问的文章，当然这不是理想的。

我应该推出自己的缓存还是可以将某些缓存代理软件配置为将其缓存基于Authorization HTTP标头？

Answer 1

尝试的一种可能性是使用Vary: Authorization响应头指示下游缓存通过根据请求的Authorization标头更改缓存的文档来小心缓存。

如果您使用响应压缩，则可能已经在使用此标头。用户通常请求标题为Accept-Encoding: gzip, deflate的资源;如果服务器配置为支持压缩，那么响应可能会随标题Content-Encoding: gzip和Vary: Accept-Encoding一起提供。

Answer 2

通过HTTP/1.1 RFC部分14.8（http://tools.ietf.org/html/rfc2616#section-14.8）：

When a shared cache (see section 13.7) receives a request 
    containing an Authorization field, it MUST NOT return the 
    corresponding response as a reply to any other request, unless one 
    of the following specific exceptions holds: 

    1. If the response includes the "s-maxage" cache-control 
    directive, the cache MAY use that response in replying to a 
    subsequent request. But (if the specified maximum age has 
    passed) a proxy cache MUST first revalidate it with the origin 
    server, using the request-headers from the new request to allow 
    the origin server to authenticate the new request. (This is the 
    defined behavior for s-maxage.) If the response includes "s- 
    maxage=0", the proxy MUST always revalidate it before re-using 
    it. 

    2. If the response includes the "must-revalidate" cache-control 
    directive, the cache MAY use that response in replying to a 
    subsequent request. But if the response is stale, all caches 
    MUST first revalidate it with the origin server, using the 
    request-headers from the new request to allow the origin server 
    to authenticate the new request. 

    3. If the response includes the "public" cache-control directive, 
    it MAY be returned in reply to any subsequent request.