startback 2.1.1 → 2.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 618541ed038c6a619973934e3430a23eebd0ac9606f91d2535fbd7354e2835b1
-  data.tar.gz: 0161c46f4272637e7ae3862eca10d5098c2f109cc28ef9e019826ca2d627aa79
+  metadata.gz: 8d29c7de7c7ebfb8c5cc68d73da62108b88cee7e24f0e59712601ed8ca8d776f
+  data.tar.gz: 4b3e850a0465313739cb45662983e6af17edeb3dce768f2dcb4a9227085a8362
 SHA512:
-  metadata.gz: a12d45c8d149de30c27658638572bc32d9d5ba6d8fb0fd92a5a94a14681be318ce79473463476e5cd67c750639affbdb5d25aafc20ae4b3accd6a649a2762d20
-  data.tar.gz: 8b3e16023edb27a7969984576b512974ad1a68277e9d08e94b8399b1c9c475a1063f0e5afd4b49141577a58ab00853ac53193bfa3d018875b87e3dec1a21d839
+  metadata.gz: 2f6b32627f15af41212ec13844db638f0d78bb5786d5151e6b0fab86b522ae294ede73bffb6cf2aff839f805eac9c85a9a6dde70a723f35d3b8da35124019c6d
+  data.tar.gz: 0070c3a2dc460fe286090ebaf0428a8697b2d0429df770542eda1b5c9f69e6c733caad05e230ab6be5d12ac75967a37be35b7264c28d3fc1f05da0c5f003e328

data/CHANGELOG.md

@@ -1,3 +1,58 @@
+## 2.1.2 - 2026-10-27
+
+A crawler could take a page down for everyone. **AutoCaching's fix needs
+nothing from you**; the second half is a middleware to mount where it helps.
+
+### An error response is never made cacheable
+
+AutoCaching stamped its production policy -- `public, must-revalidate,
+max-age=3600, s-max-age=3600` by default -- on every response that carried
+none of its own, a 4xx or a 5xx included. Whether a request is answered with
+an error usually depends on that very request: a header, a cookie, a
+credential. A cache in front of the application keys on the url alone, so one
+client's error was handed to everyone who asked for the url next, for an
+hour. Seen in the wild on a marketing site's home page, 400ing for every
+visitor behind an nginx `proxy_cache` because a crawler had asked once with a
+header it had no business sending.
+
+A response of status 400 and up now carries `no-store`, in development and in
+production alike. `no-store` rather than no header at all, because 404 and
+410 are heuristically cacheable (RFC 9111) and a shared cache may keep them
+with nothing else to go by. An application that sets its own `Cache-Control`
+on an error still wins, as it does on a success.
+
+Configurable like the other two policies, for an application that does want
+its errors cached:
+
+```ruby
+use Startback::Web::AutoCaching, error: "public, max-age=60"
+```
+
+or through `STARTBACK_AUTOCACHING_ERROR_CACHE_CONTROL`.
+
+### `Web::IgnoreContentTypeWithoutBody`
+
+What produced that 400 in the first place: a `Content-Type:
+multipart/form-data; boundary=...` on a plain GET makes Rack parse a form out
+of a body that is not there and raise `Rack::Multipart::EmptyContentError`,
+which Sinatra turns into a 400 before the route is ever reached. The url
+answers an error that has nothing to do with what it serves, and crawlers
+send that header on GETs all day. Rack is inconsistent rather than strict
+here: the same request with `Content-Length: 0` parses to no parameters at
+all.
+
+The new middleware drops the content type of a GET or a HEAD, so the route
+runs and the page is served:
+
+```ruby
+use Startback::Web::IgnoreContentTypeWithoutBody
+```
+
+Opt-in, like every middleware here. An application with a GET route that
+loads a body -- `Web::Api#loaded_body` dispatches on the request's content
+type -- would see that body become unsupported. A GET that reads a content
+type at all is unusual, content negotiation being `Accept`'s job.
+
 ## 2.1.1 - 2026-10-23
 
 The Bunny event bus keeps consuming across a broker restart. **Nothing to do

data/lib/startback/version.rb

@@ -2,7 +2,7 @@ module Startback
   module Version
     MAJOR = 2
     MINOR = 1
-    TINY  = 1
+    TINY  = 2
   end
   VERSION = "#{Version::MAJOR}.#{Version::MINOR}.#{Version::TINY}"
 end

data/lib/startback/web/auto_caching.rb

@@ -6,9 +6,18 @@ module Startback
     # This rack middleware automatically mark response as non being cacheable
     # in development, and being cacheble in production.
     #
-    # The headers to set in development and production can be passed at
-    # construction, as well as whether the development environment must be
-    # forced. This class may also be configured through environment variables:
+    # An error response is never made cacheable, in either mode. Whether a
+    # request is answered 4xx usually depends on that very request -- a header,
+    # a cookie, a credential -- while a cache in front of the application keys
+    # on the url alone, so one client's error would otherwise be served to
+    # everyone asking for the url next. It is marked `no-store` rather than
+    # merely left alone, because 404 and 410 are heuristically cacheable
+    # (RFC 9111) and a shared cache may keep them with no header to go by.
+    #
+    # The headers to set in development, in production and on an error can be
+    # passed at construction, as well as whether the development environment
+    # must be forced. This class may also be configured through environment
+    # variables:
     #
     # - RACK_ENV: when "production" use the production headers, otherwise use
     #     the development ones
@@ -16,6 +25,8 @@ module Startback
     #     to use in development mode
     # - STARTBACK_AUTOCACHING_PRODUCTION_CACHE_CONTROL: Cache-Control header
     #     to use in production mode
+    # - STARTBACK_AUTOCACHING_ERROR_CACHE_CONTROL: Cache-Control header to use
+    #     on a response of status 400 and up
     #
     # Example:
     #
@@ -31,6 +42,9 @@ module Startback
     #     # Set production headers manually
     #     use Autocaching, { :production => "public, no-cache, no-store" }
     #
+    #     # Let a shared cache keep a not found for a minute
+    #     use Autocaching, { :error => "public, max-age=60" }
+    #
     class AutoCaching
 
       # Cache-Control header to use in development mode
@@ -41,6 +55,13 @@ module Startback
       PRODUCTION_CACHE_CONTROL = ENV['STARTBACK_AUTOCACHING_PRODUCTION_CACHE_CONTROL'] ||\
                                  "public, must-revalidate, max-age=3600, s-max-age=3600"
 
+      # Cache-Control header to use on an error response, in either mode
+      ERROR_CACHE_CONTROL = ENV['STARTBACK_AUTOCACHING_ERROR_CACHE_CONTROL'] ||\
+                            "no-store"
+
+      # Lowest status this middleware considers an error
+      ERROR_STATUS = 400
+
       def initialize(app, development = nil, cache_headers = {})
         development, cache_headers = nil, development if development.is_a?(Hash)
         @app = app
@@ -50,7 +71,7 @@ module Startback
 
       def call(env)
         status, headers, body = @app.call(env)
-        [status, patch_response_headers(headers), body]
+        [status, patch_response_headers(status, headers), body]
       end
 
     protected
@@ -58,9 +79,14 @@ module Startback
       # Rack::Headers is used so that the defaults set here are actually
       # overriden by the downstream application, whatever the case it uses
       # for its own header names.
-      def patch_response_headers(hs)
-        defaults = development? ? @cache_headers[:development] : @cache_headers[:production]
-        Rack::Headers[defaults].merge(hs)
+      def patch_response_headers(status, hs)
+        Rack::Headers[defaults_for(status)].merge(hs)
+      end
+
+      def defaults_for(status)
+        return @cache_headers[:error] if status >= ERROR_STATUS
+
+        development? ? @cache_headers[:development] : @cache_headers[:production]
       end
 
       def development?
@@ -78,6 +104,9 @@ module Startback
           },
           production: {
             "cache-control" => PRODUCTION_CACHE_CONTROL
+          },
+          error: {
+            "cache-control" => ERROR_CACHE_CONTROL
           }
         }
       end

data/lib/startback/web/ignore_content_type_without_body.rb

@@ -0,0 +1,48 @@
+require 'rack'
+
+module Startback
+  module Web
+    #
+    # This Rack middleware drops the content type of a request that carries no
+    # body, that is, of a GET or a HEAD.
+    #
+    # A `Content-Type: multipart/form-data; boundary=...` on a GET makes Rack
+    # parse a form out of a body that is not there and raise
+    # `Rack::Multipart::EmptyContentError`, which Sinatra turns into a 400
+    # before the route is ever reached. The answer therefore has nothing to do
+    # with what the url serves, and crawlers send exactly that header. Rack is
+    # inconsistent here rather than strict: the same request with
+    # `Content-Length: 0` parses to no parameters at all.
+    #
+    # Mount it on an application whose GETs and HEADs ignore the request's
+    # content type, which is the usual case -- content negotiation reads
+    # `Accept`. An application with a GET route that loads a body (see
+    # `Startback::Web::Api#loaded_body`) would see that body become
+    # unsupported, hence the opt-in.
+    #
+    # Examples:
+    #
+    #     Rack::Builder.new do
+    #       use Startback::Web::IgnoreContentTypeWithoutBody
+    #     end
+    #
+    class IgnoreContentTypeWithoutBody
+
+      BODYLESS_METHODS = %w[GET HEAD]
+
+      def self.ignore_content_type?(env)
+        BODYLESS_METHODS.include?(env["REQUEST_METHOD"]) && env.key?("CONTENT_TYPE")
+      end
+
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        env.delete("CONTENT_TYPE") if self.class.ignore_content_type?(env)
+        @app.call(env)
+      end
+
+    end # class IgnoreContentTypeWithoutBody
+  end # module Web
+end # module Startback

data/spec/unit/web/test_auto_caching.rb

@@ -62,6 +62,64 @@ module Startback
         end
       end
 
+      context 'when the application answers an error in production' do
+        def cache_control_for(status)
+          app = Rack::Builder.new do
+            use AutoCaching, false
+            run ->(env){ [status, {}, ["Hello error"]] }
+          end.to_app
+          _, headers, _ = app.call(Rack::MockRequest.env_for("/"))
+          headers["cache-control"]
+        end
+
+        # A cache in front of the application keys on the url, while the error
+        # is about this request; the production policy would hand it to every
+        # later visitor of the url.
+        it 'forbids storing a bad request' do
+          expect(cache_control_for(400)).to eql("no-store")
+        end
+
+        it 'forbids storing a not found, heuristically cacheable otherwise' do
+          expect(cache_control_for(404)).to eql("no-store")
+        end
+
+        it 'forbids storing a server error' do
+          expect(cache_control_for(500)).to eql("no-store")
+        end
+
+        it 'still makes a redirect cacheable' do
+          expect(cache_control_for(301)).to eql("public, must-revalidate, max-age=3600, s-max-age=3600")
+        end
+      end
+
+      context 'when the error policy is set manually' do
+        def app
+          Rack::Builder.new do
+            use AutoCaching, false, error: "public, max-age=60"
+            run ->(env){ [404, {}, ["Hello error"]] }
+          end
+        end
+
+        it 'uses it rather than the default one' do
+          get '/'
+          expect(last_response['Cache-Control']).to eql("public, max-age=60")
+        end
+      end
+
+      context 'when the application sets its own Cache-Control on an error' do
+        def app
+          Rack::Builder.new do
+            use AutoCaching, false
+            run ->(env){ [404, {"cache-control" => "public, max-age=60"}, ["Hello error"]] }
+          end
+        end
+
+        it 'lets the application win, as on a success' do
+          get '/'
+          expect(last_response['Cache-Control']).to eql("public, max-age=60")
+        end
+      end
+
       context 'when a Cache-Control header is already set by the app' do
         def app
           Rack::Builder.new do

data/spec/unit/web/test_ignore_content_type_without_body.rb

@@ -0,0 +1,91 @@
+require 'spec_helper'
+require 'sinatra/base'
+require 'startback/web/ignore_content_type_without_body'
+
+module Startback
+  module Web
+    describe IgnoreContentTypeWithoutBody do
+      include Rack::Test::Methods
+
+      MULTIPART_CTYPE = "multipart/form-data; boundary=----WebKitFormBoundaryJ2mHj"
+
+      context 'what the application sees' do
+        # Reported as a header rather than a body, so that a HEAD can be
+        # asserted on the same way as a GET.
+        def app
+          Rack::Builder.new do
+            use IgnoreContentTypeWithoutBody
+            run ->(env){ [200, { "x-seen-content-type" => env["CONTENT_TYPE"].to_s }, []] }
+          end
+        end
+
+        def seen_content_type
+          last_response["x-seen-content-type"]
+        end
+
+        it 'hides the content type a GET has no business sending' do
+          get '/', {}, "CONTENT_TYPE" => MULTIPART_CTYPE
+          expect(seen_content_type).to eql("")
+        end
+
+        it 'hides it from a HEAD too' do
+          head '/', {}, "CONTENT_TYPE" => MULTIPART_CTYPE
+          expect(seen_content_type).to eql("")
+        end
+
+        it 'leaves the content type of a POST alone, body or no body' do
+          post '/', {}, "CONTENT_TYPE" => MULTIPART_CTYPE
+          expect(seen_content_type).to eql(MULTIPART_CTYPE)
+        end
+      end
+
+      # Rack only parses the form, and only raises, when a body is there to
+      # read and no content length says how long it is -- which is what a
+      # server hands over for a GET. Rack::Test provides neither on its own.
+      def get_with_bogus_content_type
+        get '/', {}, {
+          "CONTENT_TYPE" => MULTIPART_CTYPE,
+          "rack.input" => StringIO.new('')
+        }
+      end
+
+      class Page < Sinatra::Base
+        set :raise_errors, true
+        set :show_exceptions, false
+
+        get('/') { "hello" }
+      end
+
+      context 'on a sinatra application that serves a GET' do
+        def app
+          Rack::Builder.new do
+            use IgnoreContentTypeWithoutBody
+            run Page
+          end
+        end
+
+        it 'serves the page instead of raising on the absent body' do
+          get_with_bogus_content_type
+          expect(last_response.status).to eql(200)
+          expect(last_response.body).to eql("hello")
+        end
+      end
+
+      context 'on the same application, unprotected' do
+        def app
+          Page
+        end
+
+        # Which is what this middleware exists for. The day Rack stops telling
+        # an empty multipart body apart from a missing one, this fails and the
+        # middleware can go.
+        it 'answers a 400 that has nothing to do with the url' do
+          get_with_bogus_content_type
+          expect(last_response.status).to eql(400)
+          expect(last_response.body).to include("Invalid multipart/form-data")
+        end
+      end
+
+    end # IgnoreContentTypeWithoutBody
+  end # module Web
+end # module Startback

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: startback
 version: !ruby/object:Gem::Version
-  version: 2.1.1
+  version: 2.1.2
 platform: ruby
 authors:
 - Bernard Lambeau
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-23 00:00:00.000000000 Z
+date: 2026-10-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -529,6 +529,7 @@ files:
 - lib/startback/web/catch_all.rb
 - lib/startback/web/cors_headers.rb
 - lib/startback/web/health_check.rb
+- lib/startback/web/ignore_content_type_without_body.rb
 - lib/startback/web/middleware.rb
 - lib/startback/web/prometheus.rb
 - lib/startback/web/shield.rb
@@ -569,6 +570,7 @@ files:
 - spec/unit/web/test_catch_all.rb
 - spec/unit/web/test_cors_headers.rb
 - spec/unit/web/test_healthcheck.rb
+- spec/unit/web/test_ignore_content_type_without_body.rb
 - tasks/test.rake
 homepage: https://www.enspirit.be
 licenses: