no-transform block may interfere with cache-control headers

[zrisher]

Hi everyone,

To my dismay, I realized this week that adding the Cache-Control: No-Transform header in the way specified by the included no-transform.conf:

# Prevent mobile network providers from modifying your site
add_header "Cache-Control" "no-transform";

can cause your other cache-control values (or their defaults) to malfunction. The nginx docs state:

Note that for headers other than Last-Modified, it just appends a new header entry to the output header list. So you can't use this directive to rewrite existing headers like Server. Use the headers_more module for it.

This means that the above cache control code actually just adds another Cache-Control line in addition to the default one, which for me was Cache-Control: no-store, no-cache, must-revalidate, etc. Some browsers (Chrome) handled this fine, reading all the values. Others (Safari, Firefox) only read the last line, so ended up seeing no-transform and none of the no-cache directives.

Unfortunately, this seems to mean that if we want full unambiguous control of the cache headers, we must both compile nginx with this custom module AND set our headers in only one place for each location. Has anyone else dealt with this and come up with a better solution?

[zrisher]

Ok, found a solution:

My original cache header, with which this line interfered, was actually being passed from wordpress through my fastcgi pass. I used fastcgi_hide_header to hide these. There are similar header hiding methods in the other proxy pass techniques. You can then create your own in your location blocks. You can then use the expires directive to automatically generate them for you, or if you wanted to include the no-transform header, generate them yourself using add_header.

Finally, if your build of nginx includes the ngx_more_headers module, you could use expires to set a base of headers and overwrite the generated cache-control line with one that includes no-transform.

Ideally, the example documentation here could be updated to include a structure that elucidates this.

[jonathanbell]

Sorry to butt in on an old conversation here, but I was wondering.. Do we know which mobile providers actually do this? I have yet to see this out in the wild and, as such, do not include "no-transform" in my headers (generally).

[Malvoz]

@jonathanbell The no-transform cache-control directive not only applies to mobile providers, see this for more info: h5bp/server-configs-apache#185