Sending Vary header for AJAX requests.

[hrach]

• Browsers cache the content.
• The cache key is based on URL and other headers defined in Vary header
• Nette send different content for the same URL, detection is done by XHttpRequestWith header.

We must add Vary header, which tells the browser that the cache should depend on XHttpRequestWith header.

vojtech-dobes/nette.ajax.js@07f03cc

Related bug in Firefox (months ago fixed): https://bugzilla.mozilla.org/show_bug.cgi?id=633743

[vojtech-dobes]

👍

[dg]

And what about this? https://github.com/nette/nette/blob/master/Nette/Application/Responses/JsonResponse.php#L79

[hrach]

The problem was connected with reverting closed tab. I can imagine, that in this use-case it ignore expire header. @vojtech-dobes what was the reason for you workaroung? was it a problem only in Fx?

[vojtech-dobes]

It also happened when navigating Back, eg. I click on link to another
website, then click Back, and see the raw JSON response. I can test it in
Chrome, but my personal experienced is few days old from Firefox.

[dg]

The question is where send Vary header. In Presenter::sendPayload()?

[vojtech-dobes]

I guess that would be ideal. It seems to me fine to leave using of that header to developer's good judgement if he doesn't use payload.

[fprochazka]

I would say more like the json response? It feels more right in there.

[hrach]

Vary header should be send everytime, when the url serving different contents because of some header. This has nothing to do with sendJson (or json response), action could return json everytime, no need to send vary header. In general, this is about nette approach with snippets & ajax, so it should be send everytime we render template with snippets.

[mishak87]

Nette should send Vary always as per RFC

An HTTP/1.1 server SHOULD include a Vary header field with any cacheable response that is subject to server-driven negotiation.

Pulling snippet information from rendered template or detection if some code path is using ajax would require hacking probably with some ob_start(). What about adding config nette.response.vary = off (default: X-Requested-With, Cookie, Accept-Encoding) or something like that that would send it always.

Or maybe adding configurable headers using nette.response.headers.X-Powered-By: off (default: Nette Framework) would solve this as a feature since some fixed headers are generated by NetteExtension anyway and there is no way to turn them off.

[dg]

added nette.http.headers f59f3b1

[hrach]

Well, the added api is nice, but seem to be quite unrelated to this bug, doesn't it?

[dg]

This can not be solved automatically because when we render page we don't know if it contains a snippet. It may be inside the component.

What about send Vary header always by UI\Presenter?. Unwanted side effect is minimal and it solves the problem.

    public function run(Application\Request $request)
    {
        ... 

        if (!$this->httpResponse->isSent()) {
            $this->httpResponse->addHeader('Vary', 'X-Requested-With');
        }

[hrach]

Yes, agreed!