I have an action which returns a FileResult (which is a png image). I would dearly like for browsers to cache the result, because it doesn't change for a given request uri.
I have used routing to make the uri look like this-
http://localhost:6094/Map/Tiles/1.0.0/none/2/5/5.png
And in the action method, i call:-
Response.Cache.SetCacheability(HttpCacheability.Public);
In Fiddler, I can observe that the response has the:-
Cache-control: public
header. Yet, subsequent requests for the same map tile look like this:-
GET http://localhost:6094/Map/Tiles/1.0.0/none/2/5/5.png HTTP/1.1
Host: localhost:6094
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.34 Safari/536.11
Accept: */*
Referer: http://localhost:6094/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-GB,en-US;q=0.8,en;q=0.6
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
And so result in a 200 response, and the transfer of data.
Any idea why Chrome is not bothering to cache my data?
thanks
slip
Have you tried the OutputCache attribute? This should work fine for you but specify it's lifetime.
http://www.asp.net/mvc/tutorials/older-versions/controllers-and-routing/improving-performance-with-output-caching-cs
ex
[OutputCache(Duration=84600)]
Related
I turned on the fidder capture and entered username and password of my application and clicked login button. Now the username and password is displaying in the fiddler.
I am using primefaces. I dont want to show the password.
I added method="post" in form. but it doesnt work. Please help.
Fiddler Capure is below:
POST http://localhost:8186/myapp/ui/login.xhtml HTTP/1.1
Host: localhost:8186
Connection: keep-alive
Content-Length: 391
Accept: application/xml, text/xml, /; q=0.01
Origin: http://localhost:8186
X-Requested-With: XMLHttpRequest
Faces-Request: partial/ajax
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://localhost:8186/myapp/ui/login.xhtml
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: JSESSIONID=025A4CEED3F44EEA80E08B00154EC1EB
javax.faces.partial.ajax=true&javax.faces.source=myloginForm%3AloginButton&javax.faces.partial.execute=%40all&javax.faces.partial.render=myloginForm%3AouterPanel+myloginForm%3AstatusMsgPanel&myloginForm%3AloginButton=myloginForm%3AloginButton&myloginForm=myloginForm&myloginForm%3AuserName=user1&myloginForm%3Apassword=pass1&javax.faces.ViewState=5967922235798284125%3A-8394345289058332812
You should understand that any HTTP message by default isn't encrypted. That means that all the data is moved via insecure connection. You may even notice a warning by the browser that your connection isn't safe and you should not share any private data. The solution for this is SSL/TLS encryption. It allows you to encrypt your connection from both sides so the information would be much harder to get.
Depending of your programming language, this part should be done from the server side.
I would like to make a file download resumable using byte-range requests.
The problem is that my existing download action is responding on a POST method and I would like to keep it that way.
But it seems from my early tests that Chrome turns interrupted POST requests for file downloads into GET requests when the user tries to resume and thus the resuming of the download fails.
Am I missing something?
Is this something related to the HTTP specs that only allow GET requests to be resumed?
Or is it simply a design flaw in Chrome (and maybe other browsers as well) that makes it forget the original HTTP method used?
UPDATE:
Here are the request/response data:
Initial POST request:
POST http://localhost:35547/Download?Guid=396b4697-e275-4396-818c-548bf8c0a281 HTTP/1.1
Host: localhost:35547
Connection: keep-alive
Content-Length: 0
Cache-Control: max-age=0
Origin: http://localhost:35547
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Referer: http://localhost:35547/File/396b4697-e275-4396-818c-548bf8c0a281
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.8
Cookie: __RequestVerificationToken=LuPgM05MHrsuyskgfhsrHVUs; ASP.NET_SessionId=gfiulghfuygisghkf; .ASPXAUTH=FGDJHGDHSDFB15AFDE6371CGJHDFGFBHD; fileDownload=true
Initial response (to the request above):
HTTP/1.1 200 OK
Cache-Control: private, s-maxage=0
Content-Type: application/zip
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 5.2
Content-Disposition: attachment; filename="FILE-396b4697e2754396818c548bf8c0a281.zip"
X-AspNet-Version: 4.0.30319
Set-Cookie: fileDownload=true; path=/
X-Powered-By: ASP.NET
Date: Wed, 09 Nov 2016 11:13:50 GMT
Content-Length: 1885473
PK.......... ZIP file data .............................................
After the interruption, this is the request that the browser does on resume (notice the GET method used):
GET http://localhost:35547/Download?Guid=396b4697-e275-4396-818c-548bf8c0a281 HTTP/1.1
Host: localhost:35547
Connection: keep-alive
Referer: http://localhost:35547/File/396b4697-e275-4396-818c-548bf8c0a281
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36
Accept-Encoding: gzip, deflate, sdch, br
Accept-Language: en-US,en;q=0.8
Cookie: __RequestVerificationToken=.............
(Some data from security-related cookies have been shortened and altered)
Am I missing something ?
It depends, upon how have you analyzed the behavior of google chrome. Ideal way will be use any proxy or to use packet sniffer such as Wireshark to see what request method, is used by chrome in subsequent request.
Is this something related to the HTTP specs that only allow GET
requests to be resumed?
As of now, there's no mention in spec of HTTP protocol, that only GET requests can be resumed.
Or is it simply a design flaw in Chrome (and maybe other browsers as
well) that makes it forget the original HTTP method used?
Yes, It's the flaw of google chrome. Make sure that you check it on the latest version of Google chrome with all the update patches. Also check it on other browsers.
For more info about HTTP protocol, refer to https://www.ietf.org/rfc/rfc2616.txt.
Refer to following request, for serving partial response : https://en.wikipedia.org/wiki/Byte_serving
Edit
For more updated info regarding HTTP info, refer to :-
https://www.rfc-editor.org/rfc/rfc7230
To send an HTTP request through a socket to a server, i would do something like this:
GET / HTTP/1.0
Host: www.example.com
User-agent: SomeBot
...
How would you go about programmatically defining an HTTPS request? I'm not looking for any programming language specific answer, something that teaches me the essence of HTTPS.
My research:
When i goto https://www.google.co.in/webhp?tab=ww&ei=sg7MUvKgGoX_rAeKxoGIDg&ved=0CBQQ1S4 this is what i get:
GET https://www.google.co.in/webhp?tab=ww&ei=sg7MUvKgGoX_rAeKxoGIDg&ved=0CBQQ1S4 HTTP/1.1
:host: www.google.co.in
x-chrome-variations: COy1yQEIlLbJAQiftskBCKS2yQEIqLbJAQiptskBCL62yQEI8YPKAQ==
accept-encoding: gzip,deflate,sdch
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36
:path: /webhp?tab=ww&ei=sg7MUvKgGoX_rAeKxoGIDg&ved=0CBQQ1S4
accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
:version: HTTP/1.1
cache-control: max-age=0
cookie: PREF=ID=c032cbb31701d0d8:U=3a8fed312bb2ee57:FF=0:LD=en:TM=1374381891:LM=1376055657:S=BooLSkeTxOsbOYls; NID=67=HDIT9zwo-KKhljgRnJMz4u_5L_qpj3FvsN9Y47dWZmByQRS4N8QYs64IcEjFYphs6YpbrmvgsejwaL5YwxzbkY_qYaKU7wBfDA9N955NznF7IIyeHxcQ5UX8Dm999AElAKdkyswNbwUx1WJZo5vEuIaqC4Hdw4AkjsdwmFjY4ujPiEAj72z93QpCLleM-NXOK8N5YWn8DqiteGrEZUQ3FdPK3vkfDet_GF3CcBnkiYWxXON6R8Kum8BWaJGtm9h5dA; SID=DQAAANQAAAB2hOHWGXo76aWm_lgruhW0NH_zbU26rK7YMM_uiyMRvIBoyiEb3Gn_j2AhtmM4v6a74DinFMAOIjq5N4g4JcAAXaMEXz1dUz8MVup_nt1udNM0hpvybeWPxE1xK8rvdL2ra9moRW58jRzzA0HdpmkrH_t2ZIQ7GhqJlxp6lOS_jfvmeeb3REYFp6Q08hRYvCRDmhYFQ7NSt_Ua_3EWu4d_o125kvZ0x0bwm7JDKEcO3S-b6SJ4KnAGIWYjQKPdirgIFEUm1vApvIr4hoa4Z01rBt9YTmhwdEG5KvJmjusPkQ; HSID=AoEbPqSO97tEXhBOd; SSID=Abkp9uP00vi4wX19_; APISID=idPvNkfOQ-W9vefw/AjRgJIuDHZMDnME-B; SAPISID=5UH5pOlPn4c_31En/AcwfUulAqos_McwmH
:scheme: https
referer: https://www.google.co.in/
:method: GET
I see that it is pretty understandable, yet slightly alien...
Despite what the title may suggest, this is not related to the common "preventing double post request" issue.
In my application, I add some data on outgoing HTTP traffic, and with some some websites, I randomly encounter an HTTP POST request that has a double-header, resulting in a server termination, as I assume the server doesn't understand the request and decides to cut me off. As the title says, I'm literally seeing two POST headers in a single request. This only happens when I append some custom HTTP fields to the header. For example, I came across this today when I followed a surveygizmo.com link, as seen in the trace at the bottom of this post.
I cannot understand if it's the browser that's doing something funky because it noticed I've modified some data, or it's something in my LSP application that causes this to happen.
When I debug my application, I only see the intercepted request the first time, which is when I inject the custom data. After that, I don't see the request anywhere except in Wireshark, so it's not like I can remediate the double headers by deleting the redundant data.
Things to note looking at the trace:
The data I'm appending is 'Custom-FieldN:'
Two almost-identical headers
Three double-CRLF's in one single request header (how is that possible?)
The Request:
POST http://www.surveygizmo.com/s3/1212345/Who-Are-You HTTP/1.1
Host: www.surveygizmo.com
Custom-Field1: UserNameBob
Custom-Field2: 2578291789
proxy-connection: keep-alive
Content-Length: 836
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Origin: http://www.surveygizmo.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryaQraA7ZABICMT6jO
Referer: http://www.surveygizmo.com/s3/1212345/Who-Are-You
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-GB,en;q=0.8,en-US;q=0.6,ja;q=0.4
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: sg-response-979523-1212345=0%3B1369154430_519ba37e477bc8.35524744%3B1369154430%3BPartial
POST http://www.surveygizmo.com/s3/1212345/Who-Are-You HTTP/1.1
Host: www.surveygizmo.com
Custom-Field1: UserNameBob
Custom-Field2: 2578291789
proxy-connection: keep-alive
Content-Length: 836
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Origin: http://www.surveygizmo.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryaQraA7ZABICMT6jO
Referer: http://www.surveygizmo.com/s3/1212345/Who-Are-You
accept-encoding: gzip,deflate
Accept-Language: en-GB,en;q=0.8,en-US;q=0.6,ja;q=0.4
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: sg-response-979523-1212345=0%3B1369154430_519ba37e477bc8.35524744%3B1369154430%3BPartial
------WebKitFormBoundaryaQraA7ZABICMT6jO
Content-Disposition: form-data; name="sg_navchoice"
I dont know where this question actually goes or how to describe it but im going to try.
I have a site which works on all browsers. Now on all browsers when i move my mouse over the window nothing happens (which is correct), though on Safari, when I move my mouse over the window, i get the Page Load event firing (IsPostBack is false).
Anyone know why this is happening or how to fix it? Or even where to start?
I've looked at the headers, which are standard, there is no form data and as far as i can see there are no javascript handlers to cause this action.
Seems ive found something, though not an answer
Wehn the first requerst is done, the request header is as follows:
GET http://site/page HTTP/1.1
Host: servername.com
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.51.22 (KHTML, like Gecko) Version/5.1.1 Safari/534.51.22
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Referer: referingurl
Accept-Language: en-US
Accept-Encoding: gzip, deflate
Cookie: fontSize=small; ASP.NET_SessionId=vzjti1mpawhery3gn3q2jeb5; SSOPD=BhzM0ZnPn4qh2hqbVtN8wJrgaKycxw1tv3ly/pvpinCrBjsmAOulgZZ5ILBq2421kwMysm8MbmmgBtILxGYZ5RMWn+vbeqiaSIgi2GLszt8=
Connection: keep-alive
Proxy-Connection: keep-alive
After than when i move the mouse over the page i get this:
GET http://site/page HTTP/1.1
Host: servername.com
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.51.22 (KHTML, like Gecko) Version/5.1.1 Safari/534.51.22
Accept: /
Referer: referingurl
Accept-Language: en-US
Accept-Encoding: gzip, deflate
Cookie: fontSize=small; ASP.NET_SessionId=vzjti1mpawhery3gn3q2jeb5; SSOPD=BhzM0ZnPn4qh2hqbVtN8wJrgaKycxw1tv3ly/pvpinCrBjsmAOulgZZ5ILBq2421kwMysm8MbmmgBtILxGYZ5RMWn+vbeqiaSIgi2GLszt8=
Connection: keep-alive
Proxy-Connection: keep-alive
VB or C#? If VB, check Handles statement for page load. What does it say?
Also, any InitializeComponent code anywhere?