Bug Description
The hasDirective function in the cache middleware only recognizes a directive when it's followed by a comma (,) or end-of-string. It does not account for directives followed by a space, tab, or = (for directives with arguments).
This means headers like:
Pragma: no-cache (trailing space) — no-cache is not detected
Cache-Control: private (trailing space) — private is not detected
Cache-Control: no-cache="Set-Cookie" — no-cache is not detected
This can cause the cache middleware to serve cached responses when it shouldn't (e.g., a private response could leak into the shared cache, or a no-cache Pragma hint could be ignored).
How to Reproduce
// These all incorrectly return false:
hasDirective("no-cache ", "no-cache") // trailing space → false (should be true)
hasDirective("no-cache\t", "no-cache") // trailing tab → false (should be true)
hasDirective(`no-cache="Set-Cookie"`, "no-cache") // directive with value → false (should be true)
hasDirective("private ", "private") // trailing space → false (should be true)
Expected Behavior
hasDirective should recognize a directive as matched when it is followed by end-of-string, ,, , \t, or =, since all of these are valid terminators for a Cache-Control directive token per RFC 9111.
Fiber Version
v3 (main)
Checklist:
Bug Description
The
hasDirectivefunction in the cache middleware only recognizes a directive when it's followed by a comma (,) or end-of-string. It does not account for directives followed by a space, tab, or=(for directives with arguments).This means headers like:
Pragma: no-cache(trailing space) —no-cacheis not detectedCache-Control: private(trailing space) —privateis not detectedCache-Control: no-cache="Set-Cookie"—no-cacheis not detectedThis can cause the cache middleware to serve cached responses when it shouldn't (e.g., a
privateresponse could leak into the shared cache, or ano-cachePragma hint could be ignored).How to Reproduce
Expected Behavior
hasDirectiveshould recognize a directive as matched when it is followed by end-of-string,,,,\t, or=, since all of these are valid terminators for a Cache-Control directive token per RFC 9111.Fiber Version
v3 (main)
Checklist: