Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 291508

User password reset form should use a more precise cache context

$
0
0

Problem/Motivation

This form declares it varies by the 'url.query_args' cache context. But when I look at the code, the only query arg (GET param) it relies on is "name". So the cache context should be 'url.query_args:name'.
See #3488316: "Taxonomy term ID from URL" default views argument should have route as cache context, not url or #2983187: Use more strict views url query argument caching for similar issues and why it matters.

Performance could possibly be better with this fix because now, if someone goes to /user/password?foo=bar, then someone goes to /user/password?foo=baz, the cached result from the first call cannot be reused at the second call (it will be computed again), although the result will be exactly the same because the form does not vary by any query arg other than "name". It could have a big impact on server load for websites where many dubious bots request this page (to find security flaws, usually).

Proposed resolution

Use 'url.query_args:name' as cache context.

User interface changes

None.

API changes

None.

Data model changes

None.


Viewing all articles
Browse latest Browse all 291508

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>