faraday-http-cache 2.7.0 → 2.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9178a3cc4f43cad31ef2a21a3cac0ef2ccf1a3ea86e5667df90aee9aa58da4d3
-  data.tar.gz: 28ea9a28a3fee4f78e8da8cf7af3d84f051836475ef8f6aca0e1533f0b0bafa5
+  metadata.gz: 00c9816f80d3f4a4f700bf153c6e4b20eed4f28fc0fcbc59d3e6a9135dd864fb
+  data.tar.gz: 1298dc1a38f6529db56b8d862524268908ac09a2825678450958955b2af8f096
 SHA512:
-  metadata.gz: 1f7d626be02155cea5f5a4ad8c26070da0a35b3e7e7c0d0af5d4441da3ccd75d46c1e697700510a0abb740e0e0ce3185ca26688f946c907d2fa0a4aab3dec3e0
-  data.tar.gz: f2f881a67a1a7684ef8029932ffb51673c1ce23b49e09178fab248e6bb2648969d99bf1725d5878e9d33b682050577f441520297970cac22db0cc88ceb6e914f
+  metadata.gz: 959cd511c16d707e18369d66527bcd33dcec3de70e093f906cc688c6c68f715e2e74eefc0777e97eb00070d7edb906505b2edfd2e77e05778d66c42d33597d6b
+  data.tar.gz: 6acca89a4a35247611b553d293c627c053f7eba252ae2fa65ccc1fa07b85d5cedfb815e7924963fce288ecc113d98ca3c565426e604781aa0db2c83dd80482f6

data/README.md

@@ -62,8 +62,10 @@ you might see errors like:
 Response could not be serialized: "\xC3" from ASCII-8BIT to UTF-8. Try using Marshal to serialize.
 ```
 
-For full unicode support, or if you expect to be dealing with images, you can use the stdlib
-[Marshal][marshal] instead. Alternatively you could use another json library like `oj` or `yajl-ruby`.
+For full unicode support, or if you expect to be dealing with images, you can use another json
+library like `oj` or `yajl-ruby`, or the stdlib [Marshal][marshal]. Only pick Marshal when you fully
+trust the cache store: `Marshal.load` will instantiate any object found in the data, while the
+default `JSON` serializer parses entries into plain hashes and never instantiates classes.
 
 ```ruby
 client = Faraday.new do |builder|
@@ -214,9 +216,11 @@ The `max-age`, `must-revalidate`, `proxy-revalidate`, `s-maxage` and
 
 ### Shared vs. non-shared caches
 
-By default, the middleware acts as a "shared cache" per RFC 2616. This means it does not cache
-responses with `Cache-Control: private`. This behavior can be changed by passing in the
-`:shared_cache` configuration option:
+By default, the middleware acts as a "shared cache" per RFC 9111. This means it does not cache
+responses with `Cache-Control: private`, and it only stores and reuses responses to requests that
+carried an `Authorization` header when the response explicitly allows it with `public`,
+`must-revalidate` or `s-maxage` (RFC 9111 section 3.5). This behavior can be changed by passing in
+the `:shared_cache` configuration option:
 
 ```ruby
 client = Faraday.new do |builder|

data/lib/faraday/http_cache/response.rb

@@ -98,6 +98,22 @@ module Faraday
         cacheable?(false)
       end
 
+      # Internal: Checks if a shared cache may reuse this response for requests
+      # other than the one that carried an 'Authorization' header.
+      #
+      # RFC 9111 section 3.5: a shared cache must not use a cached response to
+      # a request with an 'Authorization' header to satisfy any subsequent
+      # request unless the response carries a 'Cache-Control' directive that
+      # explicitly allows it. The directives with that effect are
+      # 'must-revalidate', 'public' and 's-maxage'.
+      #
+      # Returns true if one of those directives is present.
+      def shared_cache_authorized?
+        cache_control.public? ||
+          cache_control.must_revalidate? ||
+          !cache_control.shared_max_age.nil?
+      end
+
       # Internal: Gets the response age in seconds.
       #
       # Returns the 'Age' header if present, or subtracts the response 'date'

data/lib/faraday/http_cache/strategies/base_strategy.rb

@@ -29,7 +29,9 @@ module Faraday
         # @option options [Faraday::HttpCache::MemoryStore, nil] :store - a cache
         #   store object that should respond to 'read', 'write', and 'delete'.
         # @option options [#dump#load] :serializer - an object that should
-        #   respond to 'dump' and 'load'.
+        #   respond to 'dump' and 'load'. 'load' must never instantiate classes
+        #   named by the data, since the cached entries contain response headers
+        #   sent by the origin server.
         # @option options [Logger, nil] :logger - an object to be used to emit warnings.
         def initialize(options = {})
           @cache = options[:store] || Faraday::HttpCache::MemoryStore.new
@@ -80,7 +82,12 @@ module Faraday
         end
 
         def deserialize_object(object)
-          @serializer.load(object).transform_keys(&:to_sym)
+          # JSON.load enables create_additions, so a `json_class` key in the
+          # entry would instantiate that class. Response headers are stored
+          # verbatim, which lets an origin server plant such a key. JSON.parse
+          # only ever builds plain Ruby objects.
+          loaded = @serializer.equal?(::JSON) ? ::JSON.parse(object) : @serializer.load(object)
+          loaded.transform_keys(&:to_sym)
         end
 
         def warn(message)

data/lib/faraday/http_cache/version.rb

@@ -2,6 +2,6 @@
 
 module Faraday
   class HttpCache
-    VERSION = '2.7.0'
+    VERSION = '2.8.0'
   end
 end

data/lib/faraday/http_cache.rb

@@ -196,7 +196,7 @@ module Faraday
     def process(env)
       entry = @strategy.read(@request)
 
-      return fetch(env) if entry.nil?
+      return fetch(env) if entry.nil? || !reusable?(entry)
 
       if entry.fresh? && !@request.no_cache?
         response = entry.to_response(env)
@@ -270,7 +270,7 @@ module Faraday
     #
     # Returns nothing.
     def store(response)
-      if shared_cache? ? response.cacheable_in_shared_cache? : response.cacheable_in_private_cache?
+      if storable?(response)
         trace :store
         @strategy.write(@request, response)
       else
@@ -278,6 +278,41 @@ module Faraday
       end
     end
 
+    # Internal: Checks if the response may be stored by this cache instance.
+    # A shared cache also refuses responses to requests that carried an
+    # 'Authorization' header unless the response explicitly allows it
+    # (RFC 9111 section 3.5), so what is never stored is never served to
+    # another caller.
+    #
+    # response - a 'Faraday::HttpCache::Response' instance.
+    #
+    # Returns true or false.
+    def storable?(response)
+      return response.cacheable_in_private_cache? unless shared_cache?
+      return false if authorization_bearing? && !response.shared_cache_authorized?
+
+      response.cacheable_in_shared_cache?
+    end
+
+    # Internal: Checks if a stored entry may be served for the current request.
+    # Entries written by earlier versions of this middleware may be responses
+    # to authenticated requests that a shared cache must not reuse; such an
+    # entry is treated as a miss and replaced.
+    #
+    # entry - a 'Faraday::HttpCache::Response' read from the strategy.
+    #
+    # Returns true or false.
+    def reusable?(entry)
+      return true unless shared_cache? && authorization_bearing?
+
+      entry.shared_cache_authorized?
+    end
+
+    # Internal: Checks if the current request carries an 'Authorization' header.
+    def authorization_bearing?
+      !@request.headers['Authorization'].nil?
+    end
+
     def delete(request, response)
       headers = %w[Location Content-Location]
       headers.each do |header|

data/spec/http_cache_spec.rb

@@ -121,6 +121,48 @@ describe Faraday::HttpCache do
       expect(logger).to receive(:debug) { |&block| expect(block.call).to eq('HTTP Cache: [GET /private] miss, uncacheable') }
       client.get('private')
     end
+
+    describe 'responses to requests with an "Authorization" header' do
+      def get_as(user, path = 'authenticated')
+        client.get(path) { |request| request.headers['Authorization'] = "Bearer #{user}" }
+      end
+
+      it 'does not serve one caller the response cached for another' do
+        alice = get_as('alice')
+        bob = get_as('bob')
+
+        expect(alice.body).to eq('1:Bearer alice')
+        expect(bob.body).to eq('2:Bearer bob')
+      end
+
+      it 'logs that the response is uncacheable' do
+        expect(logger).to receive(:debug) { |&block| expect(block.call).to eq('HTTP Cache: [GET /authenticated] miss, uncacheable') }
+        get_as('alice')
+      end
+
+      it 'caches responses that are explicitly marked as public' do
+        get_as('alice', 'authenticated-public')
+        bob = get_as('bob', 'authenticated-public')
+
+        expect(bob.body).to eq('1:Bearer alice')
+      end
+
+      it 'does not serve entries stored before the authorization check existed' do
+        store = Faraday::HttpCache::MemoryStore.new
+        clients = [false, true].map do |shared|
+          Faraday.new(url: ENV['FARADAY_SERVER']) do |stack|
+            stack.use Faraday::HttpCache, store: store, shared_cache: shared
+            stack.adapter ENV['FARADAY_ADAPTER'].to_sym
+          end
+        end
+        private_client, shared_client = clients
+
+        private_client.get('authenticated') { |request| request.headers['Authorization'] = 'Bearer alice' }
+        bob = shared_client.get('authenticated') { |request| request.headers['Authorization'] = 'Bearer bob' }
+
+        expect(bob.body).to eq('2:Bearer bob')
+      end
+    end
   end
 
   describe 'when acting as a private cache' do
@@ -135,6 +177,13 @@ describe Faraday::HttpCache do
       expect(logger).to receive(:debug) { |&block| expect(block.call).to eq('HTTP Cache: [GET /private] miss, store') }
       client.get('private')
     end
+
+    it 'caches responses to requests with an "Authorization" header' do
+      client.get('authenticated') { |request| request.headers['Authorization'] = 'Bearer alice' }
+      bob = client.get('authenticated') { |request| request.headers['Authorization'] = 'Bearer bob' }
+
+      expect(bob.body).to eq('1:Bearer alice')
+    end
   end
 
   it 'does not cache responses with a explicit no-store directive' do

data/spec/spec_helper.rb

@@ -16,6 +16,7 @@ require 'active_support/cache'
 
 require 'support/test_app'
 require 'support/test_server'
+require 'support/json_gadget'
 
 server = TestServer.new
 

data/spec/strategies/by_url_spec.rb

@@ -16,6 +16,20 @@ describe Faraday::HttpCache::Strategies::ByUrl do
   let(:strategy) { described_class.new(store: cache) }
   subject { strategy }
 
+  describe 'deserializing entries' do
+    let(:response) { double(serializable_hash: { response_headers: { 'json_class' => 'JsonGadget' } }) }
+
+    before { JsonGadget.invocations.clear }
+
+    it 'never instantiates classes named by the cached data' do
+      strategy.write(request, response)
+      cached = strategy.read(request)
+
+      expect(JsonGadget.invocations).to be_empty
+      expect(cached.payload[:response_headers]['json_class']).to eq('JsonGadget')
+    end
+  end
+
   describe 'Cache configuration' do
     it 'uses a MemoryStore by default' do
       expect(Faraday::HttpCache::MemoryStore).to receive(:new).and_call_original

data/spec/strategies/by_vary_spec.rb

@@ -23,6 +23,20 @@ describe Faraday::HttpCache::Strategies::ByVary do
   let(:strategy) { described_class.new(store: cache) }
   subject { strategy }
 
+  describe 'deserializing entries' do
+    let(:response_payload) { { response_headers: { 'Vary' => vary, 'json_class' => 'JsonGadget' } } }
+
+    before { JsonGadget.invocations.clear }
+
+    it 'never instantiates classes named by the cached data' do
+      strategy.write(request, response)
+      cached = strategy.read(request)
+
+      expect(JsonGadget.invocations).to be_empty
+      expect(cached.payload[:response_headers]['json_class']).to eq('JsonGadget')
+    end
+  end
+
   describe 'storing responses' do
     shared_examples 'A strategy with serialization' do
       it 'writes the response object to the underlying cache' do

data/spec/support/json_gadget.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# A class that records every attempt to build it through JSON.load's
+# create_additions hook, so specs can assert cached entries never do that.
+class JsonGadget
+  def self.invocations
+    @invocations ||= []
+  end
+
+  def self.json_create(attributes)
+    invocations << attributes
+    new
+  end
+end

data/spec/support/test_app.rb

@@ -85,6 +85,14 @@ class TestApp < Sinatra::Base
     halt 405
   end
 
+  get '/authenticated' do
+    [200, { 'Cache-Control' => 'max-age=200' }, "#{increment_counter}:#{env['HTTP_AUTHORIZATION']}"]
+  end
+
+  get '/authenticated-public' do
+    [200, { 'Cache-Control' => 'public, max-age=200' }, "#{increment_counter}:#{env['HTTP_AUTHORIZATION']}"]
+  end
+
   get '/private' do
     [200, { 'Cache-Control' => 'private, max-age=100' }, increment_counter]
   end

metadata

@@ -1,15 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: faraday-http-cache
 version: !ruby/object:Gem::Version
-  version: 2.7.0
+  version: 2.8.0
 platform: ruby
 authors:
 - Lucas Mazza
 - George Guimarães
 - Gustavo Araujo
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-09-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -59,6 +60,7 @@ files:
 - spec/strategies/by_url_spec.rb
 - spec/strategies/by_vary_spec.rb
 - spec/support/empty.png
+- spec/support/json_gadget.rb
 - spec/support/test_app.rb
 - spec/support/test_server.rb
 - spec/validation_spec.rb
@@ -66,6 +68,7 @@ homepage: https://github.com/sourcelevel/faraday-http-cache
 licenses:
 - Apache-2.0
 metadata: {}
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -80,7 +83,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
 summary: A Faraday middleware that stores and validates cache expiration.
 test_files:
@@ -97,6 +101,7 @@ test_files:
 - spec/strategies/by_url_spec.rb
 - spec/strategies/by_vary_spec.rb
 - spec/support/empty.png
+- spec/support/json_gadget.rb
 - spec/support/test_app.rb
 - spec/support/test_server.rb
 - spec/validation_spec.rb