restrict ETag handling to GET/HEAD and enforce user-specific caching

- Process only GET and HEAD methods to ensure middleware relevance and avoid unnecessary processing for non-cacheable HTTP methods. - Add a check to determine if the response is cacheable, filtering out non-cacheable responses (e.g., those with 'no-store' directive or non-cacheable status codes). - Default ETag generation now includes user-specific data (auth()->id()) to enforce personalized caching by default. - Removed 'scope' and 'includeUser' logic for simplified and consistent caching behavior.
eiresendez · Dec 6, 2024 · Dec 2, 2024 · Dec 2, 2024 · Dec 3, 2024 · Dec 5, 2024
commit 8b327c8a016ed5674acda8cb68511a0679e9bd0e
diff --git a/ProcessMaker/Http/Middleware/Etag/HandleEtag.php b/ProcessMaker/Http/Middleware/Etag/HandleEtag.php
@@ -14,22 +14,23 @@ class HandleEtag
     /**
      * Handle an incoming request.
      */
-    public function handle(Request $request, Closure $next, ?string $scope = null): Response
+    public function handle(Request $request, Closure $next): Response
     {
-        // Save original method and support HEAD requests.
-        $originalMethod = $request->getMethod();
-        if ($request->isMethod('HEAD')) {
-            $request->setMethod('GET');
+        // Process only GET and HEAD methods.
+        if (!$request->isMethod('GET') && !$request->isMethod('HEAD')) {
+            return $next($request);
         }
 
         // Handle response.
         $response = $next($request);
 
-        // Determine if the ETag should include user-specific data.
-        $includeUser = $scope === 'user';
+        // Check if the response is cacheable.
+        if (!$this->isCacheableResponse($response)) {
+            return $response; // Skip ETag for non-cacheable responses.
+        }
 
         // Generate ETag for the response.
-        $etag = EtagManager::getEtag($request, $response, $includeUser);
+        $etag = EtagManager::getEtag($request, $response);
         if ($etag) {
             // Set the ETag header.
             $response->setEtag($etag);
@@ -43,9 +44,6 @@ public function handle(Request $request, Closure $next, ?string $scope = null):
             }
         }
 
-        // Restore original method and return the response.
-        $request->setMethod($originalMethod);
-
         return $response;
     }
 
@@ -56,4 +54,17 @@ private function stripWeakTags(string $etag): string
     {
         return str_replace('W/', '', $etag);
     }
+
+    /**
+     * Determine if a response is cacheable.
+     */
+    private function isCacheableResponse(Response $response): bool
+    {
+        $cacheableStatusCodes = [200, 203, 204, 206, 304];
+        $cacheControl = $response->headers->get('Cache-Control', '');
+
+        // Verify if the status code is cacheable and does not contain "no-store".
+        return in_array($response->getStatusCode(), $cacheableStatusCodes)
+            && !str_contains($cacheControl, 'no-store');
+    }
 }
diff --git a/ProcessMaker/Http/Resources/Caching/EtagManager.php b/ProcessMaker/Http/Resources/Caching/EtagManager.php
@@ -23,26 +23,22 @@ public static function etagGenerateUsing(?Closure $callback): void
     }
 
     /**
-     * Get ETag value for this request and response.
+     * Get the ETag value for this request and response.
      */
-    public static function getEtag(Request $request, Response $response, bool $includeUser = false): string
+    public static function getEtag(Request $request, Response $response): string
     {
         $etag = static::$etagGenerateCallback
-            ? call_user_func(static::$etagGenerateCallback, $request, $response, $includeUser)
-            : static::defaultGetEtag($response, $includeUser);
+            ? call_user_func(static::$etagGenerateCallback, $request, $response)
+            : static::defaultGetEtag($response);
 
         return (string) Str::of($etag)->start('"')->finish('"');
     }
 
     /**
-     * Generate an ETag, optionally including user-specific data.
+     * Generate a default ETag, including user-specific data by default.
      */
-    private static function defaultGetEtag(Response $response, bool $includeUser = false): string
+    private static function defaultGetEtag(Response $response): string
     {
-        if ($includeUser) {
-            return md5(auth()->id() . $response->getContent());
-        }
-
-        return md5($response->getContent());
+        return md5(auth()->id() . $response->getContent());
     }
 }