faraday-http-cache 2.6.1 → 2.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9d83bc178f6be84f8807a6357f4d60aefbdde828a0b63355b4517aa7a2e3dca0
-  data.tar.gz: d1543b1549fc3924d15bba59947f7b46aa05609043328f7ce84bec56cea16e45
+  metadata.gz: 00c9816f80d3f4a4f700bf153c6e4b20eed4f28fc0fcbc59d3e6a9135dd864fb
+  data.tar.gz: 1298dc1a38f6529db56b8d862524268908ac09a2825678450958955b2af8f096
 SHA512:
-  metadata.gz: 863ec060abd499c032a62be09cbb4ac5c0d00529a3af5c2ffff79c2c538eb56adbb4b2932eb3be55670f00777fe887383398b64cb457510a8a822176367e9040
-  data.tar.gz: 5817a00b39242a99cd7539b2bf883606faa68bad7aba448e7dda23490de02ee9de3814b6f7b3932edf1d86e7d66cd011badc8a637fa7725ca0e89cb018b6a9aa
+  metadata.gz: 959cd511c16d707e18369d66527bcd33dcec3de70e093f906cc688c6c68f715e2e74eefc0777e97eb00070d7edb906505b2edfd2e77e05778d66c42d33597d6b
+  data.tar.gz: 6acca89a4a35247611b553d293c627c053f7eba252ae2fa65ccc1fa07b85d5cedfb815e7924963fce288ecc113d98ca3c565426e604781aa0db2c83dd80482f6

data/README.md

@@ -62,8 +62,10 @@ you might see errors like:
 Response could not be serialized: "\xC3" from ASCII-8BIT to UTF-8. Try using Marshal to serialize.
 ```
 
-For full unicode support, or if you expect to be dealing with images, you can use the stdlib
-[Marshal][marshal] instead. Alternatively you could use another json library like `oj` or `yajl-ruby`.
+For full unicode support, or if you expect to be dealing with images, you can use another json
+library like `oj` or `yajl-ruby`, or the stdlib [Marshal][marshal]. Only pick Marshal when you fully
+trust the cache store: `Marshal.load` will instantiate any object found in the data, while the
+default `JSON` serializer parses entries into plain hashes and never instantiates classes.
 
 ```ruby
 client = Faraday.new do |builder|
@@ -72,6 +74,31 @@ client = Faraday.new do |builder|
 end
 ```
 
+### Stale-While-Revalidate and background refresh hooks
+
+The middleware supports `stale-while-revalidate` directives from the `Cache-Control` header.
+When a cached response is stale but still inside the `stale-while-revalidate` window, the middleware
+will serve the stale response immediately.
+
+You can provide an `:on_stale` callback to trigger your own asynchronous refresh logic:
+
+```ruby
+client = Faraday.new do |builder|
+  builder.use :http_cache,
+    store: Rails.cache,
+    on_stale: lambda { |request:, env:, cached_response:|
+      RefreshApiCacheJob.perform_later(request.url.to_s)
+    }
+  builder.adapter Faraday.default_adapter
+end
+```
+
+The callback receives:
+
+- `request`: `Faraday::HttpCache::Request`
+- `env`: current `Faraday::Env`
+- `cached_response`: `Faraday::HttpCache::Response`
+
 ### Strategies
 
 You can provide a `:strategy` option to the middleware to specify the strategy to use.
@@ -140,6 +167,8 @@ processes a request. In the event payload, `:env` contains the response Faraday
 - `:valid` means that the cached response *could* be validated against the server.
 - `:fresh` means that the cached response was still fresh and could be returned without even
   calling the server.
+- `:stale` means that the cached response was stale, but served while inside
+  `stale-while-revalidate` window.
 
 ```ruby
 client = Faraday.new do |builder|
@@ -154,7 +183,7 @@ ActiveSupport::Notifications.subscribe "http_cache.faraday" do |*args|
   statsd = Statsd.new
 
   case cache_status
-  when :fresh, :valid
+  when :fresh, :valid, :stale
     statsd.increment('api-calls.cache_hits')
   when :invalid, :miss
     statsd.increment('api-calls.cache_misses')
@@ -168,6 +197,7 @@ end
 
 You can clone this repository, install its dependencies with Bundler (run `bundle install`) and
 execute the files under the `examples` directory to see a sample of the middleware usage.
+For stale-while-revalidate behavior with `:on_stale`, see `examples/stale_while_revalidate.rb`.
 
 ## What gets cached?
 
@@ -181,13 +211,16 @@ The middleware will use the following headers to make caching decisions:
 
 ### Cache-Control
 
-The `max-age`, `must-revalidate`, `proxy-revalidate` and `s-maxage` directives are checked.
+The `max-age`, `must-revalidate`, `proxy-revalidate`, `s-maxage` and
+`stale-while-revalidate` directives are checked.
 
 ### Shared vs. non-shared caches
 
-By default, the middleware acts as a "shared cache" per RFC 2616. This means it does not cache
-responses with `Cache-Control: private`. This behavior can be changed by passing in the
-`:shared_cache` configuration option:
+By default, the middleware acts as a "shared cache" per RFC 9111. This means it does not cache
+responses with `Cache-Control: private`, and it only stores and reuses responses to requests that
+carried an `Authorization` header when the response explicitly allows it with `public`,
+`must-revalidate` or `s-maxage` (RFC 9111 section 3.5). This behavior can be changed by passing in
+the `:shared_cache` configuration option:
 
 ```ruby
 client = Faraday.new do |builder|

data/lib/faraday/http_cache/cache_control.rb

@@ -68,6 +68,13 @@ module Faraday
         @directives['proxy-revalidate']
       end
 
+      # Internal: Gets the 'stale-while-revalidate' directive as an Integer.
+      #
+      # Returns nil if the 'stale-while-revalidate' directive isn't present.
+      def stale_while_revalidate
+        @directives['stale-while-revalidate'].to_i if @directives.key?('stale-while-revalidate')
+      end
+
       # Internal: Gets the String representation for the cache directives.
       # Directives are joined by a '=' and then combined into a single String
       # separated by commas. Directives with a 'true' value will omit the '='

data/lib/faraday/http_cache/response.rb

@@ -54,6 +54,18 @@ module Faraday
         !cache_control.no_cache? && ttl && ttl > 0
       end
 
+      # Internal: Checks if the response is stale but can still be served while
+      # revalidating in the background.
+      #
+      # Returns true when the response has exceeded freshness lifetime, but is
+      # still inside the stale-while-revalidate window.
+      def stale_while_revalidate?
+        return false if cache_control.no_cache?
+        return false unless ttl && stale_while_revalidate
+
+        ttl <= 0 && -ttl <= stale_while_revalidate
+      end
+
       # Internal: Checks if the Response returned a 'Not Modified' status.
       #
       # Returns true if the response status code is 304.
@@ -86,6 +98,22 @@ module Faraday
         cacheable?(false)
       end
 
+      # Internal: Checks if a shared cache may reuse this response for requests
+      # other than the one that carried an 'Authorization' header.
+      #
+      # RFC 9111 section 3.5: a shared cache must not use a cached response to
+      # a request with an 'Authorization' header to satisfy any subsequent
+      # request unless the response carries a 'Cache-Control' directive that
+      # explicitly allows it. The directives with that effect are
+      # 'must-revalidate', 'public' and 's-maxage'.
+      #
+      # Returns true if one of those directives is present.
+      def shared_cache_authorized?
+        cache_control.public? ||
+          cache_control.must_revalidate? ||
+          !cache_control.shared_max_age.nil?
+      end
+
       # Internal: Gets the response age in seconds.
       #
       # Returns the 'Age' header if present, or subtracts the response 'date'
@@ -123,6 +151,13 @@ module Faraday
           (expires && (expires - @now))
       end
 
+      # Internal: Gets the stale-while-revalidate value in seconds.
+      #
+      # Returns an Integer or nil.
+      def stale_while_revalidate
+        cache_control.stale_while_revalidate
+      end
+
       # Internal: Creates a new 'Faraday::Response', merging the stored
       # response with the supplied 'env' object.
       #

data/lib/faraday/http_cache/strategies/base_strategy.rb

@@ -29,7 +29,9 @@ module Faraday
         # @option options [Faraday::HttpCache::MemoryStore, nil] :store - a cache
         #   store object that should respond to 'read', 'write', and 'delete'.
         # @option options [#dump#load] :serializer - an object that should
-        #   respond to 'dump' and 'load'.
+        #   respond to 'dump' and 'load'. 'load' must never instantiate classes
+        #   named by the data, since the cached entries contain response headers
+        #   sent by the origin server.
         # @option options [Logger, nil] :logger - an object to be used to emit warnings.
         def initialize(options = {})
           @cache = options[:store] || Faraday::HttpCache::MemoryStore.new
@@ -80,7 +82,12 @@ module Faraday
         end
 
         def deserialize_object(object)
-          @serializer.load(object).transform_keys(&:to_sym)
+          # JSON.load enables create_additions, so a `json_class` key in the
+          # entry would instantiate that class. Response headers are stored
+          # verbatim, which lets an origin server plant such a key. JSON.parse
+          # only ever builds plain Ruby objects.
+          loaded = @serializer.equal?(::JSON) ? ::JSON.parse(object) : @serializer.load(object)
+          loaded.transform_keys(&:to_sym)
         end
 
         def warn(message)

data/lib/faraday/http_cache/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Faraday
+  class HttpCache
+    VERSION = '2.8.0'
+  end
+end

data/lib/faraday/http_cache.rb

@@ -6,6 +6,7 @@ require 'faraday/http_cache/storage'
 require 'faraday/http_cache/request'
 require 'faraday/http_cache/response'
 require 'faraday/http_cache/strategies'
+require 'faraday/http_cache/version'
 
 module Faraday
   # Public: The middleware responsible for caching and serving responses.
@@ -60,6 +61,9 @@ module Faraday
       # The response was cached and can still be used.
       :fresh,
 
+      # The response was stale but served while revalidating asynchronously.
+      :stale,
+
       # The response was cached and the server has validated it with a 304 response.
       :valid,
 
@@ -84,6 +88,8 @@ module Faraday
     # :shared_cache    - A flag to mark the middleware as a shared cache or not.
     # :instrumenter    - An instrumentation object that should respond to 'instrument'.
     # :instrument_name - The String name of the instrument being reported on (optional).
+    # :on_stale        - A Proc/lambda called with request:, env:, cached_response: when
+    #                    a stale response is served within stale-while-revalidate window.
     # :logger          - A logger object.
     # :max_entries     - The maximum number of entries to store per cache key. This option is only
     #                    used when using the +ByUrl+ cache strategy.
@@ -103,7 +109,7 @@ module Faraday
     #   # Initialize the middleware with a MemoryStore and logger
     #   store = ActiveSupport::Cache.lookup_store
     #   Faraday::HttpCache.new(app, store: store, logger: my_logger)
-    def initialize(app, options = {})
+    def initialize(app, options = {}, &block)
       super(app)
 
       options = options.dup
@@ -111,6 +117,7 @@ module Faraday
       @shared_cache = options.delete(:shared_cache) { true }
       @instrumenter = options.delete(:instrumenter)
       @instrument_name = options.delete(:instrument_name) { EVENT_NAME }
+      @on_stale = options.delete(:on_stale) || block
 
       strategy = options.delete(:strategy) { Strategies::ByUrl }
 
@@ -189,11 +196,15 @@ module Faraday
     def process(env)
       entry = @strategy.read(@request)
 
-      return fetch(env) if entry.nil?
+      return fetch(env) if entry.nil? || !reusable?(entry)
 
       if entry.fresh? && !@request.no_cache?
         response = entry.to_response(env)
         trace :fresh
+      elsif entry.stale_while_revalidate? && !@request.no_cache?
+        response = entry.to_response(env)
+        trace :stale
+        on_stale(env, entry)
       else
         trace :must_revalidate
         response = validate(entry, env)
@@ -259,7 +270,7 @@ module Faraday
     #
     # Returns nothing.
     def store(response)
-      if shared_cache? ? response.cacheable_in_shared_cache? : response.cacheable_in_private_cache?
+      if storable?(response)
         trace :store
         @strategy.write(@request, response)
       else
@@ -267,6 +278,41 @@ module Faraday
       end
     end
 
+    # Internal: Checks if the response may be stored by this cache instance.
+    # A shared cache also refuses responses to requests that carried an
+    # 'Authorization' header unless the response explicitly allows it
+    # (RFC 9111 section 3.5), so what is never stored is never served to
+    # another caller.
+    #
+    # response - a 'Faraday::HttpCache::Response' instance.
+    #
+    # Returns true or false.
+    def storable?(response)
+      return response.cacheable_in_private_cache? unless shared_cache?
+      return false if authorization_bearing? && !response.shared_cache_authorized?
+
+      response.cacheable_in_shared_cache?
+    end
+
+    # Internal: Checks if a stored entry may be served for the current request.
+    # Entries written by earlier versions of this middleware may be responses
+    # to authenticated requests that a shared cache must not reuse; such an
+    # entry is treated as a miss and replaced.
+    #
+    # entry - a 'Faraday::HttpCache::Response' read from the strategy.
+    #
+    # Returns true or false.
+    def reusable?(entry)
+      return true unless shared_cache? && authorization_bearing?
+
+      entry.shared_cache_authorized?
+    end
+
+    # Internal: Checks if the current request carries an 'Authorization' header.
+    def authorization_bearing?
+      !@request.headers['Authorization'].nil?
+    end
+
     def delete(request, response)
       headers = %w[Location Content-Location]
       headers.each do |header|
@@ -312,6 +358,14 @@ module Faraday
       Request.from_env(env)
     end
 
+    def on_stale(env, cached_response)
+      return unless @on_stale
+
+      @on_stale.call(request: @request, env: env, cached_response: cached_response)
+    rescue StandardError => e
+      @logger&.warn("HTTP Cache: on_stale callback failed: #{e.class}: #{e.message}")
+    end
+
     # Internal: Logs the trace info about the incoming request
     # and how the middleware handled it.
     # This method does nothing if theresn't a logger present.

data/spec/cache_control_spec.rb

@@ -106,4 +106,14 @@ describe Faraday::HttpCache::CacheControl do
     cache_control = Faraday::HttpCache::CacheControl.new('max-age=600')
     expect(cache_control).not_to be_no_cache
   end
+
+  it 'responds to #stale_while_revalidate with an integer when directive present' do
+    cache_control = Faraday::HttpCache::CacheControl.new('public, max-age=60, stale-while-revalidate=300')
+    expect(cache_control.stale_while_revalidate).to eq(300)
+  end
+
+  it 'responds to #stale_while_revalidate with nil when directive absent' do
+    cache_control = Faraday::HttpCache::CacheControl.new('public, max-age=60')
+    expect(cache_control.stale_while_revalidate).to be_nil
+  end
 end

data/spec/http_cache_spec.rb

@@ -121,6 +121,48 @@ describe Faraday::HttpCache do
       expect(logger).to receive(:debug) { |&block| expect(block.call).to eq('HTTP Cache: [GET /private] miss, uncacheable') }
       client.get('private')
     end
+
+    describe 'responses to requests with an "Authorization" header' do
+      def get_as(user, path = 'authenticated')
+        client.get(path) { |request| request.headers['Authorization'] = "Bearer #{user}" }
+      end
+
+      it 'does not serve one caller the response cached for another' do
+        alice = get_as('alice')
+        bob = get_as('bob')
+
+        expect(alice.body).to eq('1:Bearer alice')
+        expect(bob.body).to eq('2:Bearer bob')
+      end
+
+      it 'logs that the response is uncacheable' do
+        expect(logger).to receive(:debug) { |&block| expect(block.call).to eq('HTTP Cache: [GET /authenticated] miss, uncacheable') }
+        get_as('alice')
+      end
+
+      it 'caches responses that are explicitly marked as public' do
+        get_as('alice', 'authenticated-public')
+        bob = get_as('bob', 'authenticated-public')
+
+        expect(bob.body).to eq('1:Bearer alice')
+      end
+
+      it 'does not serve entries stored before the authorization check existed' do
+        store = Faraday::HttpCache::MemoryStore.new
+        clients = [false, true].map do |shared|
+          Faraday.new(url: ENV['FARADAY_SERVER']) do |stack|
+            stack.use Faraday::HttpCache, store: store, shared_cache: shared
+            stack.adapter ENV['FARADAY_ADAPTER'].to_sym
+          end
+        end
+        private_client, shared_client = clients
+
+        private_client.get('authenticated') { |request| request.headers['Authorization'] = 'Bearer alice' }
+        bob = shared_client.get('authenticated') { |request| request.headers['Authorization'] = 'Bearer bob' }
+
+        expect(bob.body).to eq('2:Bearer bob')
+      end
+    end
   end
 
   describe 'when acting as a private cache' do
@@ -135,6 +177,13 @@ describe Faraday::HttpCache do
       expect(logger).to receive(:debug) { |&block| expect(block.call).to eq('HTTP Cache: [GET /private] miss, store') }
       client.get('private')
     end
+
+    it 'caches responses to requests with an "Authorization" header' do
+      client.get('authenticated') { |request| request.headers['Authorization'] = 'Bearer alice' }
+      bob = client.get('authenticated') { |request| request.headers['Authorization'] = 'Bearer bob' }
+
+      expect(bob.body).to eq('1:Bearer alice')
+    end
   end
 
   it 'does not cache responses with a explicit no-store directive' do
@@ -221,6 +270,61 @@ describe Faraday::HttpCache do
     client.get('get')
   end
 
+  describe 'stale-while-revalidate' do
+    let(:on_stale) { double('stale callback', call: nil) }
+    let(:options) { { logger: logger, on_stale: on_stale } }
+
+    it 'serves stale cached responses within stale-while-revalidate window' do
+      expect(client.get('stale-while-revalidate').body).to eq('1')
+
+      response = client.get('stale-while-revalidate')
+      expect(response.body).to eq('1')
+      expect(response.env[:http_cache_trace]).to eq([:stale])
+    end
+
+    it 'invokes the on_stale callback with request, env and cached response' do
+      client.get('stale-while-revalidate')
+
+      expect(on_stale).to receive(:call).with(
+        request: an_instance_of(Faraday::HttpCache::Request),
+        env: an_instance_of(Faraday::Env),
+        cached_response: an_instance_of(Faraday::HttpCache::Response)
+      )
+
+      client.get('stale-while-revalidate')
+    end
+
+    it 'ignores on_stale callback errors and still serves stale response' do
+      failing_callback = lambda do |request:, env:, cached_response:|
+        request && env && cached_response
+        raise 'boom'
+      end
+
+      local_client = Faraday.new(url: ENV['FARADAY_SERVER']) do |stack|
+        stack.use Faraday::HttpCache, logger: logger, on_stale: failing_callback
+        adapter = ENV['FARADAY_ADAPTER']
+        stack.headers['X-Faraday-Adapter'] = adapter
+        stack.headers['Content-Type'] = 'application/x-www-form-urlencoded'
+        stack.adapter adapter.to_sym
+      end
+
+      local_client.get('stale-while-revalidate')
+      expect(logger).to receive(:warn).with(/on_stale callback failed: RuntimeError: boom/)
+
+      response = local_client.get('stale-while-revalidate')
+      expect(response.body).to eq('1')
+      expect(response.env[:http_cache_trace]).to eq([:stale])
+    end
+
+    it 'revalidates when stale-while-revalidate window has expired' do
+      expect(client.get('stale-while-revalidate-expired').body).to eq('1')
+
+      response = client.get('stale-while-revalidate-expired')
+      expect(response.body).to eq('1')
+      expect(response.env[:http_cache_trace]).to eq(%i[must_revalidate valid store])
+    end
+  end
+
   it 'sends the "Last-Modified" header on response validation' do
     client.get('timestamped')
     expect(client.get('timestamped').body).to eq('1')

data/spec/instrumentation_spec.rb

@@ -43,6 +43,16 @@ describe 'Instrumentation' do
       expect(events.last.payload.fetch(:cache_status)).to eq(:fresh)
     end
 
+    it 'is :stale if the cache entry is stale but can be served while revalidating' do
+      backend.get('/hello') do
+        [200, { 'Cache-Control' => 'public, max-age=0, stale-while-revalidate=60', 'Date' => Time.now.httpdate, 'Etag' => '123ABCD' }, '']
+      end
+
+      client.get('/hello') # miss
+      client.get('/hello') # stale
+      expect(events.last.payload.fetch(:cache_status)).to eq(:stale)
+    end
+
     it 'is :valid if the cache entry can be validated against the upstream' do
       backend.get('/hello') do
         headers = {

data/spec/response_spec.rb

@@ -199,6 +199,29 @@ describe Faraday::HttpCache::Response do
     end
   end
 
+  describe 'stale while revalidate' do
+    it 'is true when response is stale but inside stale-while-revalidate window' do
+      headers = { 'Cache-Control' => 'max-age=60, stale-while-revalidate=20', 'Date' => (Time.now - 70).httpdate }
+      response = Faraday::HttpCache::Response.new(response_headers: headers)
+
+      expect(response).to be_stale_while_revalidate
+    end
+
+    it 'is false when response is stale and outside stale-while-revalidate window' do
+      headers = { 'Cache-Control' => 'max-age=60, stale-while-revalidate=20', 'Date' => (Time.now - 90).httpdate }
+      response = Faraday::HttpCache::Response.new(response_headers: headers)
+
+      expect(response).not_to be_stale_while_revalidate
+    end
+
+    it 'is false when no-cache is set' do
+      headers = { 'Cache-Control' => 'max-age=60, stale-while-revalidate=20, no-cache', 'Date' => (Time.now - 70).httpdate }
+      response = Faraday::HttpCache::Response.new(response_headers: headers)
+
+      expect(response).not_to be_stale_while_revalidate
+    end
+  end
+
   describe 'response unboxing' do
     subject { described_class.new(status: 200, response_headers: {}, body: 'Hi!', reason_phrase: 'Success') }
 

data/spec/spec_helper.rb

@@ -16,6 +16,7 @@ require 'active_support/cache'
 
 require 'support/test_app'
 require 'support/test_server'
+require 'support/json_gadget'
 
 server = TestServer.new
 

data/spec/strategies/by_url_spec.rb

@@ -16,6 +16,20 @@ describe Faraday::HttpCache::Strategies::ByUrl do
   let(:strategy) { described_class.new(store: cache) }
   subject { strategy }
 
+  describe 'deserializing entries' do
+    let(:response) { double(serializable_hash: { response_headers: { 'json_class' => 'JsonGadget' } }) }
+
+    before { JsonGadget.invocations.clear }
+
+    it 'never instantiates classes named by the cached data' do
+      strategy.write(request, response)
+      cached = strategy.read(request)
+
+      expect(JsonGadget.invocations).to be_empty
+      expect(cached.payload[:response_headers]['json_class']).to eq('JsonGadget')
+    end
+  end
+
   describe 'Cache configuration' do
     it 'uses a MemoryStore by default' do
       expect(Faraday::HttpCache::MemoryStore).to receive(:new).and_call_original

data/spec/strategies/by_vary_spec.rb

@@ -23,6 +23,20 @@ describe Faraday::HttpCache::Strategies::ByVary do
   let(:strategy) { described_class.new(store: cache) }
   subject { strategy }
 
+  describe 'deserializing entries' do
+    let(:response_payload) { { response_headers: { 'Vary' => vary, 'json_class' => 'JsonGadget' } } }
+
+    before { JsonGadget.invocations.clear }
+
+    it 'never instantiates classes named by the cached data' do
+      strategy.write(request, response)
+      cached = strategy.read(request)
+
+      expect(JsonGadget.invocations).to be_empty
+      expect(cached.payload[:response_headers]['json_class']).to eq('JsonGadget')
+    end
+  end
+
   describe 'storing responses' do
     shared_examples 'A strategy with serialization' do
       it 'writes the response object to the underlying cache' do

data/spec/support/json_gadget.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# A class that records every attempt to build it through JSON.load's
+# create_additions hook, so specs can assert cached entries never do that.
+class JsonGadget
+  def self.invocations
+    @invocations ||= []
+  end
+
+  def self.json_create(attributes)
+    invocations << attributes
+    new
+  end
+end

data/spec/support/test_app.rb

@@ -61,6 +61,18 @@ class TestApp < Sinatra::Base
     [200, { 'Cache-Control' => 'max-age=200' }, increment_counter]
   end
 
+  get '/stale-while-revalidate' do
+    [200, { 'Cache-Control' => 'max-age=0, stale-while-revalidate=120', 'Date' => Time.now.httpdate, 'ETag' => 'stale' }, increment_counter]
+  end
+
+  get '/stale-while-revalidate-expired' do
+    if env['HTTP_IF_NONE_MATCH'] == '1'
+      [304, {}, '']
+    else
+      [200, { 'Cache-Control' => 'max-age=0, stale-while-revalidate=1', 'Date' => settings.yesterday, 'ETag' => '1' }, increment_counter]
+    end
+  end
+
   post '/delete-with-location' do
     [200, { 'Location' => "#{request.base_url}/get" }, '']
   end
@@ -73,6 +85,14 @@ class TestApp < Sinatra::Base
     halt 405
   end
 
+  get '/authenticated' do
+    [200, { 'Cache-Control' => 'max-age=200' }, "#{increment_counter}:#{env['HTTP_AUTHORIZATION']}"]
+  end
+
+  get '/authenticated-public' do
+    [200, { 'Cache-Control' => 'public, max-age=200' }, "#{increment_counter}:#{env['HTTP_AUTHORIZATION']}"]
+  end
+
   get '/private' do
     [200, { 'Cache-Control' => 'private, max-age=100' }, increment_counter]
   end

metadata

@@ -1,16 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: faraday-http-cache
 version: !ruby/object:Gem::Version
-  version: 2.6.1
+  version: 2.8.0
 platform: ruby
 authors:
 - Lucas Mazza
 - George Guimarães
 - Gustavo Araujo
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-01-19 00:00:00.000000000 Z
+date: 2026-09-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -46,6 +46,7 @@ files:
 - lib/faraday/http_cache/strategies/base_strategy.rb
 - lib/faraday/http_cache/strategies/by_url.rb
 - lib/faraday/http_cache/strategies/by_vary.rb
+- lib/faraday/http_cache/version.rb
 - spec/binary_spec.rb
 - spec/cache_control_spec.rb
 - spec/http_cache_spec.rb
@@ -59,6 +60,7 @@ files:
 - spec/strategies/by_url_spec.rb
 - spec/strategies/by_vary_spec.rb
 - spec/support/empty.png
+- spec/support/json_gadget.rb
 - spec/support/test_app.rb
 - spec/support/test_server.rb
 - spec/validation_spec.rb
@@ -66,7 +68,7 @@ homepage: https://github.com/sourcelevel/faraday-http-cache
 licenses:
 - Apache-2.0
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -81,24 +83,25 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
 summary: A Faraday middleware that stores and validates cache expiration.
 test_files:
-- spec/spec_helper.rb
-- spec/validation_spec.rb
-- spec/strategies/by_vary_spec.rb
-- spec/strategies/by_url_spec.rb
-- spec/strategies/base_strategy_spec.rb
-- spec/json_spec.rb
+- spec/binary_spec.rb
+- spec/cache_control_spec.rb
+- spec/http_cache_spec.rb
 - spec/instrumentation_spec.rb
+- spec/json_spec.rb
+- spec/request_spec.rb
+- spec/response_spec.rb
+- spec/spec_helper.rb
 - spec/storage_spec.rb
-- spec/http_cache_spec.rb
-- spec/binary_spec.rb
-- spec/support/test_app.rb
+- spec/strategies/base_strategy_spec.rb
+- spec/strategies/by_url_spec.rb
+- spec/strategies/by_vary_spec.rb
 - spec/support/empty.png
+- spec/support/json_gadget.rb
+- spec/support/test_app.rb
 - spec/support/test_server.rb
-- spec/request_spec.rb
-- spec/cache_control_spec.rb
-- spec/response_spec.rb
+- spec/validation_spec.rb