6

I'm using Apache 2.4.25 to expose a number of back-end services using proxy pass. Apache also sets the cache control headers based on mime type. The current cache configuration looks like this:

ExpiresActive on
ExpiresDefault "now"
ExpiresByType text/html "now"
ExpiresByType image/gif "access plus 120 minutes"
ExpiresByType image/jpeg "access plus 120 minutes"
ExpiresByType image/png "access plus 120 minutes"
ExpiresByType text/css "access plus 60 minutes"
ExpiresByType text/javascript "access plus 60 minutes"
ExpiresByType application/x-javascript "access plus 60 minutes"
ExpiresByType text/xml "access plus 60 minutes"
ExpiresByType application/javascript "access plus 60 minutes"
ExpiresByType application/x-font-ttf "access plus 30 days"
ExpiresByType application/x-font-woff "access plus 30 days"
ExpiresByType application/x-font-eot "access plus 30 days"
ExpiresByType application/x-font-svg "access plus 30 days"

However, one of the back-end services is also setting the cache-control max-age header. This is causing the response header to contain two max-age settings.

Duplicate max-agent values as seen in Chrome

How does the browser react when presented with two max-age settings with different values? Also, is it possible to check for an existing cache-control header before adding the default?

1
  • using set instead of add seems like the right thing to do, but I am still curious about how browsers interpret a duplicate setting. The RFC for Cache-control does not seem to specify any particular strategy: tools.ietf.org/html/rfc7234#section-5.2 so maybe it's simply undefined. If that's the case, I wonder if all browsers actually handle it in different ways, or maybe there's an implicit standard they all adhere to?
    – Jon z
    May 10 '18 at 15:14
2

Use Header "set" instead of Header "add" if you don't want accidental duplicates due to backend sending the same header.

1
  • It seems like the ExpiresByType directive must be doing a header "add" instead of "set" then. Would you recommend that I set the cache-control header another way then? Feb 27 '17 at 20:44
1

According to the latest mod_expires docs: http://httpd.apache.org/docs/current/mod/mod_expires.html

When the Expires header is already part of the response generated by the server [...] this module does not change or add an Expires or Cache-Control header.

So one option is to get your backend to set an Expires header in addition to the Cache-Control header it's already setting. For instance, in PHP:

$seconds = 60;
header("Expires: ". gmdate('D, d M Y H:i:s', time() + $seconds). ' GMT');
header("Cache-Control: max-age=". $seconds);
0

When the Expires header is already part of the response generated by the server [...] this module does not change or add an Expires or Cache-Control header.

It isn't true, Apache still adds additional Cache-Control and Expires headers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.