Skip to content

🐛 [Bug]: Cache middleware hasDirective misses directives followed by space, tab, or '=' #4143

@mango766

Description

@mango766

Bug Description

The hasDirective function in the cache middleware only recognizes a directive when it's followed by a comma (,) or end-of-string. It does not account for directives followed by a space, tab, or = (for directives with arguments).

This means headers like:

  • Pragma: no-cache (trailing space) — no-cache is not detected
  • Cache-Control: private (trailing space) — private is not detected
  • Cache-Control: no-cache="Set-Cookie"no-cache is not detected

This can cause the cache middleware to serve cached responses when it shouldn't (e.g., a private response could leak into the shared cache, or a no-cache Pragma hint could be ignored).

How to Reproduce

// These all incorrectly return false:
hasDirective("no-cache ", "no-cache")             // trailing space → false (should be true)
hasDirective("no-cache\t", "no-cache")            // trailing tab → false (should be true)
hasDirective(`no-cache="Set-Cookie"`, "no-cache") // directive with value → false (should be true)
hasDirective("private ", "private")               // trailing space → false (should be true)

Expected Behavior

hasDirective should recognize a directive as matched when it is followed by end-of-string, ,, , \t, or =, since all of these are valid terminators for a Cache-Control directive token per RFC 9111.

Fiber Version

v3 (main)

Checklist:

  • I agree to follow Fiber's Code of Conduct.
  • I have checked for existing issues that describe my problem prior to opening this one.
  • I understand that improperly formatted bug reports may be closed without explanation.

Metadata

Metadata

Assignees

Type

No type

Projects

Status

No status

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions