Cross-domain caching
Looking at the list of HTTP headers at Wikipedia, you'll notice a few headers like If-Modified-Since, that serve to send content over only if it has changed since the last request.
While working with JavaScrip frameworks like jQuery, the thought occurred to me, that maybe half of all the websites I open are using the exact same JS framework, isn't that a waste of bandwidth?
The best real-life solution would be to get your JS from Google, so you at least share a cached version with others that do the same: http://code.google.com/apis/ajaxlibs/
My imaginary solution however, would allow the same file, served from different hosts to be cached only once.
Look again at the list of headers... We're looking for something to identify files as equal... What about Content-MD5? It exists, right there! But as far as I can tell it's used for content-verification only.
So I want to propose a new HTTP header: If-MD5-Differs
What do you think about it? Cool? Useless? Security issues?
Posted on Saturday, Feb 20, 2010
5 Comments
I do not know anything about hashing algorithms, but if Ubuntu can provide a MD5 sum on their website to verify the download, I'd think MD5 sums can be generated in a persistent manner.
So, you could start to implement this today. Just have your HTTP client (web browser or what have you) associated ETags not only to entire URLs but also to just the final, file portion. When visiting a new site first send check ETags for cached files based upon the site's file's full URL, then try an ETag for another site's URL whose file name matches, and finally only download the file if the first two options have failed.
However, I wouldn't recommend doing this, as this is rife for abuse and is essentially a cross site scripting attack. Just think about malicious sites sending out malicious files associated with known good hashes (e.g. malicious code backed by the ETag of a known jQuery release), only for users to execute the cached, bad code when visiting a banking website. Of course, if you know how the ETag is generated the client can recalculate the hash against the file you've received and throw out the file if they don't match...
All in all, it's an interesting though and might be really interesting to see in action.
Kun je aan een domme oom die digibeet is uitleggen waar dit over gaat want hoewel ik de engelse taal toch redelijk kan volgen geld dat absoluut niet voor het bezoek aan deze grappig uitziende maar voor mij onbegrijpelijke site.Wat is de bedoeling.Jean-Pierre
De bedoeling is dat ik dingen schrijf over computers wat ik tegen kom, en dat mensen die dat interessant vinden dat dan kunnen lezen en er op reageren.
Leave a Comment