Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit ad66d7a

Browse filesBrowse files
lanthalerweaverryan
authored andcommitted
Rephrased the note about the clock skew vulnerability of the Expires header.
1 parent 18308ca commit ad66d7a
Copy full SHA for ad66d7a

File tree

Expand file treeCollapse file tree

1 file changed

+7
-6
lines changed
Filter options
Expand file treeCollapse file tree

1 file changed

+7
-6
lines changed

‎book/http_cache.rst

Copy file name to clipboardExpand all lines: book/http_cache.rst
+7-6Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -464,11 +464,12 @@ The resulting HTTP header will look like this::
464464
The ``setExpires()`` method automatically converts the date to the GMT
465465
timezone as required by the specification.
466466

467-
Note that the ``Expires`` header is not vulnerable to clock skew, since the
468-
lifetime is calculated using the ``Date`` header which comes from the
469-
origin server as well instead of using the local clock.
470-
The specification states that "HTTP/1.1 servers should not send ``Expires`` dates
471-
more than one year in the future."
467+
Note that in HTTP versions before 1.1 the origin server wasn't required to
468+
send the ``Date`` header. Consequently the cache (e.g. the browser) might
469+
need to rely onto his local clock to evaluate the ``Expires`` header making
470+
the lifetime calculation vulnerable to clock skew. Another limitation
471+
of the ``Expires`` header is that the specification states that "HTTP/1.1
472+
servers should not send ``Expires`` dates more than one year in the future."
472473

473474
.. index::
474475
single: Cache; Cache-Control header
@@ -1045,4 +1046,4 @@ Learn more from the Cookbook
10451046
.. _`HTTP Bis`: http://tools.ietf.org/wg/httpbis/
10461047
.. _`P4 - Conditional Requests`: http://tools.ietf.org/html/draft-ietf-httpbis-p4-conditional-12
10471048
.. _`P6 - Caching: Browser and intermediary caches`: http://tools.ietf.org/html/draft-ietf-httpbis-p6-cache-12
1048-
.. _`ESI`: http://www.w3.org/TR/esi-lang
1049+
.. _`ESI`: http://www.w3.org/TR/esi-lang

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.