https://bz.apache.org/bugzilla/show_bug.cgi?id=70289
--- Comment #2 from abernal <[email protected]> --- Follow-up: while hardening the PR, found and fixed a second, related bug in cache_select() (modules/cache/cache_storage.c): when matching a stored response's Vary header, a "*" token was looked up as a literal request header named "*", which is always absent on both sides, so it was treated as a match instead of RFC 9111 4.1's "Vary: * always fails to match" rule. That meant a Vary: * entry already on disk (e.g. from before this fix, or written during a rolling upgrade) could still be served to the wrong client even with the store-side fix alone. Both fixes are now in PR #909: https://github.com/apache/httpd/pull/909 -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
