Contrib.social

Return cacheable responses from SecuritytxtController

Open on Drupal.org →
Created on 15 May 2025, 18 days ago

Problem/Motivation

Currently, both the ::securitytxtFile() and the ::securitytxtSignature() methods for the SecuritytxtController controller return uncacheable Response objects, which results in a Cache-Control header value of must-revalidate, no-cache, private. The results in unnecessary requests bootstrapping at origin.

Steps to reproduce

  1. Load /.well-known/security.txt.
  2. Observe the Cache-Control header.

Proposed resolution

Return a CacheableResponse object instead.

The TTL of both the /.well-known/security.txt and /.well-known/security.txt.sig files need to be kept in sync to prevent a cached-induced mismatch. The two files are interdependent and so are their cache invalidations. Proposal: Set the max-age equal to the policy expires timestamp minus the request timestamp.

Remaining tasks

  1. Open MR
  2. Community review

User interface changes

None.

API changes

None.

Data model changes

None.

✨ Feature request
Status

Active

Version

1.0

Component

Code

Created by

🇺🇸United States Chris Burge

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024