Skip to content

core: Ignore If-Modified-Since and If-Unmodified-Since without a modification date. - #862

Open
arturobernalg wants to merge 1 commit into
apache:trunkfrom
arturobernalg:fix/httpd-39287-ims-no-lastmod
Open

arturobernalg wants to merge 1 commit into
apache:trunkfrom
arturobernalg:fix/httpd-39287-ims-no-lastmod

Conversation

@arturobernalg

Copy link
Copy Markdown
Member

When a resource has no modification date (a CGI script that sends no Last-Modified, for example), ap_condition_if_modified_since() and ap_condition_if_unmodified_since() used the current time as its date. So a request with an If-Modified-Since of the current second got a 304, and any If-Unmodified-Since in the past got a 412, for content that has no date at all.

RFC 9110 13.1.3 and 13.1.4 say a recipient MUST ignore these headers if the resource does not have a modification date available. This does that: without a valid Last-Modified and without r->mtime the condition is ignored.

This is https://bz.apache.org/bugzilla/show_bug.cgi?id=39287. The same code is in 2.4.x.

I added a test in test/modules/core with a few small CGI scripts (no Last-Modified, invalid Last-Modified, and one with a valid date as a control). Without the change 5 of the 6 tests fail, with it they all pass. I also ran test/modules/core, test/modules/http1 and the pytest_suite apache, cache, negotiation, cgi and include tests before and after, with no other difference.


  • This PR does not report or address a security vulnerability
    (see SECURITY.md and
    https://www.apache.org/security/#reporting-a-vulnerability).
  • Code follows the httpd style guide.
  • New log messages (level debug or higher) use an empty APLOGNO() tag;
    numbers are assigned by a committer at merge time (see docs/log-message-tags/README).
  • If the change is user-visible, a changes-entries/*.txt file is included,
    following the template in README.CHANGES (not needed otherwise).
  • Test cases based on pyhttpd are included where appropriate, in the
    test/modules/xxx directory matching the modules/xxx module source,
    or test/modules/core for core server changes. On Unix, verify these
    pass locally with e.g. make check-pytest PYTEST_DIRS=test/modules/xxx.

…fication date.

For a resource with no modification date, like a CGI script which sends no
Last-Modified, ap_condition_if_modified_since() and
ap_condition_if_unmodified_since() compared the request with the current
time, so such a request could get a wrong 304 or 412. RFC 9110 sections
13.1.3 and 13.1.4 say to ignore the condition in that case.

PR 39287.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant