-
-
Notifications
You must be signed in to change notification settings - Fork 9.7k
Description
Symfony version(s) affected: all
Description
Symfony uses the strong comparison function when comparing entity-tags (ETags) for If-None-Match header, however according to RFC 7232 ietf.org and mozilla.org, it must use the weak comparison function.
Code where it happens github.com
Comparison table (Symfony uses Strong comparison) ietf.org
RFC 7232 ietf.org
mozilla.org
How to reproduce
In the response set strong etag, like $response->setEtag('testEtag', false);
It will add header to the response ETag: "testEtag"
Make a request, sending the header: If-None-Match: W/"testEtag"
(by the way, FF sends weak etags even if strong etag was received)
The server will reply with body and 200, however it must return 304 Not Modified response without body.
Possible Solution
Replace '\W'
with ''
here and compare without it.
Additional context
Request:
GET /cached HTTP/1.1
Host: localhost:8082
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cache-Control: public
If-None-Match: W/"testEtag"
Response:
HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: public
ETag: "testEtag"
Content-Encoding: gzip