Apache module deflate disables server cache

[LukeOwlclaw]

On my server I had Apache module deflate enabled (sudo a2enmod deflate).
I noticed that my server never returned HTTP response 304 (not modified) but instead always returns the whole document (with HTTP code 200).
Turns out, that there is for many years an issue with handling Etags together with the modified-since headers (-> https://issues.apache.org/bugzilla/show_bug.cgi?id=45023)

Is this an issue which oc should handle gracefully? Maybe by warning the admin? Or can we just ignore it?

One option would be of course to disable deflate module: sudo a2dismod deflate

Another is to rewrite the "If-None-Match" header, sent by the client via .htaccess:

<ifModule mod_headers.c>
    <ifModule mod_deflate.c>
    RequestHeader  edit "If-None-Match" "(.*)-gzip" "$1"
  </ifModule>
</ifModule>

However, this requires: sudo a2enmod headers

[karlitschek]

Yes. We definitely should detect this and give a warning.

[LukasReschke]

Generally speaking enabling a deflate mechanism is from a security PoV anyways a bad idea when using TLS: https://en.wikipedia.org/wiki/BREACH_%28security_exploit%29

[LukeOwlclaw]

So then it would be best if during installation deflate was disabled via .htaccess?

<ifModule mod_deflate.c>
   SetEnv no-gzip 1
</ifModule>

[ghost]

A possible solution was posten a longer time ago here: #4783 (comment)

[PVince81]

Hmm, is mod_deflate still corrupting files nowadays ?

[ghost]

Good question, we still have also #4783 open.

[PVince81]

closing in favor of #4783

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.