andrewdavey/cassette — Issue #187: After upgrading to 1.0.2 images return 403 forbidden
Author: jslaybaugh
Created: 2012-02-22 21:59:00+00:00
State: open

I mentioned this earlier on twitter and thought it was just an issue with my cache in chrome, because if I did a hard refresh, all the images came through. But then all throughout the day (even after clearing my chrome cache) they would still come back as forbidden on normal refreshes. On twitter, you mentioned that 1.1 might resolve this: https://twitter.com/#!/getcassette/status/172348135602003969

I went in and with NuGet updated to 1.1.0-beta4 and it appears that everything is good--the images show up consistently. However, in the 1.0.2 security announcement: http://groups.google.com/group/cassette/browse_thread/thread/61333cf79bd16815?pli=1, you mention that 1.1 still suffers from the vulnerability that 1.0.2 fixes, so I thought i'd still add this issue. (My thinking is--perhaps naively--that if you ultimately do the same thing to 1.1 that fixed 1.0.2, then we might run into the same problem in 1.1.) Here (http://www.diigo.com/item/image/2283i/nkq7) is a screenshot of what it looks like in chrome console. It's strange, because if I right click on the forbidden resource and tell chrome to open it in a new tab and refresh a bunch, it might come up one of those times. I think it has something to do with the 304 redirect caused by the cache-control headers and the way chrome handles those. Your tweets led me to believe that this wouldn't be a problem in `debug="false"` and that seems true in my limited testing, but its really a pain trying to code in `debug="true"` when half the page doesn't load.

So, as it stands right now, i'm on 1.1.0-beta4, and that's probably ok for the short term, because I don't plan on putting this into production for the next little bit.

Hopefully this helps...

-- Jorin