Questions[http-caching](server)

There's a similar question but solution there doesn't work for me.

We have nginx and uWSGI ad backend. We need nginx to cache the backend response according to what is in the response header.

For example, I run curl -I https://example.com/api/project_data/. Using tcpdump I see the backend responds:

HTTP/1.1 200 OK
Content-Type: application/json
Vary: Accept, Accept-Language, Origin
Allow: GET, HEAD, OPTIONS
Cache-Control: public, max-age=3600
X-Request-ID: 6aa...0d99
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Set-Cookie:  longterm_session=45c6...67; Domain=example.com;

Nevertheless, the response isn't cached and nginx knoks to the backend every time the request received.

The nginx config:

http {
        uwsgi_cache_path /var/local/nginx_cache levels=2:2 use_temp_path=off inactive=1h keys_zone=mycache:20m ;
....

  server {
    ....
    uwsgi_cache mycache;
    uwsgi_cache_key "$request_method$request_uri";

    location /api/project_data/ {
      add_header X-Cache $upstream_cache_status;
      add_header Pragma "public";
      uwsgi_pass 127.0.0.1:49002;
      include uwsgi_params;

      uwsgi_cache mycache;
      uwsgi_cache_key "$request_method$request_uri";

    }

I duplicated uwsgi_cache just to be on the safe side because afaik some directives are not inherited into location. Also, there's x-cache: MISS in the response nginx sends to the client.

What am I doing wrong?

I use server management software plesk with apache and nginx. I set in apache and nginx a expired header for javascript files for one year. That's working. I can see one year for "expires" in header.

Now I want access javascript and php files with a rewrite (without redirect).

APACHE

ExpiresActive On
ExpiresByType text/javascript A31556952

RewriteEngine On
RewriteRule fake/(.+\.(?:js|php))$ original/$1 [L]

NGINX

location ~* ^/(.*\.js)$ {
    try_files $uri @fallback;

    expires 1y;
    add_header Cache-Control "public";
}

That RewriteRule is working. I can access this files, but the "expires" header in "fake/file.js" is gone. What am I doing wrong?

example.com/original/file.js = expires in one year

example.com/fake/file.js = no header for expires

SOLUTION All static files are normally processing by NGINX, not apache. So set in apache this line for javascript give it a cache.

Header set Cache-Control "max-age=31556952, public"

Flag [L] in RewriteRule must stop static files processing by nginx and ExpiresByType is ignored.

I've never seen a good answer to this dilemma, and I've been searching high and low. It seems it is a choice between using a nonce and caching, you can't have both. Really bad choice!

We're told 'unsafe-inline' is a really bad choice in CSP, and yet there seems to be no solution to the cache/nonce problem, that I've found.

Is there any solution on the horizon? Or one available now which is simply a well-kept secret?

Before even attempting to setup something that wouldn't work, I'd like to understand if the following configuration has a logic.

Basically we want to stop Chromebooks to steal bandwidth on updates. Google suggests to setup a local web caching server so that requests to dl.google.com are cached in LAN, saving 400mb online requests per each Chromebook.

This could be done setting up a local web caching proxy (squid?) and declare this as a proxy in the Chromebook configuration, however, as I would like to limit request to the local web caching server only for dl.google.com and nothing else, I thought I could create a local DNS record on the LAN's DNS server, so that requests to dl.google.com are forwarded to the local proxy.

In your opinion, will this work, or will the proxy refuse/ignore requests from hosts that are not intrinsically configured to use a proxy?

I'm using nginx's expires directive; its etag directive as well as the Last-Modified header (if I understand correctly) are on by default.

In order to allow specific inline JavaScripts when using restrictive Content Security Policy (CSP) headers (i.e. no 'unsafe-inline' resource policy) I want to use nonces.

I've basically followed the article by Scott Helme on the matter, using nginx's $request_id in my trial to create the nonce as discussed on ServerFault (in order to try this quickly without having to build nginx from scratch).

When I tried this it seemed that caching no longer worked as I expected, however:
Nginx responded with the file and fresh Last-Modified and ETag headers each time, instead of the 304 Not Modified response I was hoping for.

Thinking about it, it makes sense: the nonce in the CSP header as well as in the source code changes with each request. However, nothing else changes. So, arguably, this is a change that a "weak validator" should ignore (and thus mark the requested resource as not changed).

Having said that, I know very little to nothing about server configuration, or caching headers, for that matter. Chances are the smattering of knowledge I have isn't helping, and that weak validators, for example, aren't supposed to work that way, anyway.

Additionally, there seems to be an issue that browsers get confused when they have a cached version of the file with the old nonce but get a 304 Not Modified header with a new nonce (although I haven't seen that myself in my trial).

My question is thus basically: is it possible to configure nginx so that caching works in a way where changes to the nonce only (i.e. changes that happen on the fly by text replacement) are ignored when nginx creates the Last-Modified and ETag headers (i.e. where it only looks at the file changes on disk) - effectively using what are probably weak validators?

And, assuming browser confusion is an issue, can you do something to stop it, like not return a CSP header when the server returns 304 (so as not to replace the "header" nonce the browser has by a new one that then doesn't match the "file" one)? (This is more an academic question; I suppose I could somehow try not to set the CSP header for a 304 response, maybe using the ngx_headers_more module.)

Do I effectively have the choice between using nonces or caching? Or should this work out of the box (and whatever I saw was down to something else)?