rtomayko/rack-cache — Issue #52: Rack::Cache caches Set-Cookie response headers
Author: rmm5t
Created: 2012-02-02 16:06:48+00:00
State: open

Rack::Cache v0.3.0 (see [changelog](https://github.com/rtomayko/rack-cache/blob/master/CHANGES)) introduced the behavior such that it will cache "responses marked as explicitly public even when the request includes an Authorization or Cookie header."

We're having a difficult time understanding why a `Set-Cookie` header should ever be cached.

We have a Rails application that has a few `fresh_when` and `stale?` checks that also happen to have a Cookie header sent in the request because the cookie's domain matches. Specifically, this cookie is our Rails session_store, and we started to experience hijacked sessions between users.

These resources that end up getting a public cache control as part of the response also have the Set-Cookie header set and Rack::Cache will cache the cookies because the response was set explicitly public.

We'd like to propose preventing Rack::Cache from ever caching a Set-Cookie header. @rtomayko [touched on this as a potential solution to a related problem](https://github.com/rails/rails/issues/476#issuecomment-1180999) that dealt with cached assets.