Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I've been using the most excellent http://redbot.org tool for testing have HTTP headers on my site correct (its custom code in PHP serving dynamic content - wanting to ensure it cached where possible - served by Apache2)

One of the tests says:

The If-Modified-Since response is missing required headers

HTTP requires 304 Not Modified responses to have certain headers, if they are also present in a normal (e.g., 200 OK response).
This response is missing the following headers: last-modified.
This can affect cache operation; because the headers are missing, caches might remove them from their cached copies.

... so resonse doesnt include the Last-Modified header. However the code does try to send it. Investigating further, it seems that Apache uses a whitelist of HTTP headers, it will allow on 304 responses...

if (r->status == HTTP_NOT_MODIFIED) {
    apr_table_do((int (*)(void *, const char *, const char *)) form_header_field,
                 (void *) &h, r->headers_out,
                 "Connection",
                 "Keep-Alive",
                 "ETag",
                 "Content-Location",
                 "Expires",
                 "Cache-Control",
                 "Vary",
                 "Warning",
                 "WWW-Authenticate",
                 "Proxy-Authenticate",
                 "Set-Cookie",
                 "Set-Cookie2",
                 NULL);
}
else {
    send_all_header_fields(&h, r);
}

This is found around line 1281 in modules/http/http_filters.c of the Apache HTTPD 2.2.22 source code.

.... "Last-Modified" is not on that list.

So the question is - which is wrong, redbot, or Apache?

http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html doesn't seem to specify if the Last-Modified should be included. (it does say the Etag should be - and that is allowed in Apaches list)

Just incase its useful, this is the test case: http://redbot.org/?uri=http%3A%2F%2Fwww.geograph.org.uk%2Fhelp%2Fsitemap - my code does include the Last-Modified header - its just that redbot never gets it (nor any custom X-.. headers).

share|improve this question
    
Why would the Not Modified response need a Last-Modified header? I can't think of any use cases where this would be required. If you're getting a 304, then you already fetched a previous copy and know the last-modified date, which hasn't changed since then. –  Lèse majesté Feb 6 '12 at 5:24
    
that is pretty much the question. But redbot suggests otherwise - which is what I am questioning. It seems the thinking is caches will update the headers of the 'stored' object with those in the 304 - and as the last modified is now missing, it will be lost from the cached object. -- I supose some testing is needed :) - its worth noting I've never observed any issue with 304s not including the header - 304s continue to be issued for the same object - its just that the advice of redbot suggets otherwise. –  barryhunter Feb 6 '12 at 12:00
add comment

2 Answers

up vote 5 down vote accepted

You're correct. RED implemented the requirements from HTTPbis http://tools.ietf.org/html/draft-ietf-httpbis-p4-conditional-18#section-4.1.

Normally, HTTPbis requirements are backwards-compatible with RFC2616 (i.e., they don't make implementations that were conformant to 2616 non-conformance now), but this change slipped through -- we'll be opening an issue to fix that, and in the meantime I'll change REDs requirements.

share|improve this answer
    
great thanks! Sorry i didnt find a more direct way to contact you! –  barryhunter Feb 7 '12 at 14:35
add comment

No, Last-Modified is not required, as you cited from RFC 2616. I've found this issue https://github.com/mnot/redbot/issues/61 in which they implemented the check for required headers. However, they stated in the issue that only "Date" was required, but the implementation was different (by mistake, I think).

share|improve this answer
    
Ah thanks for that - I failed to find the github project for redbot - otherwise probably would of posted this there. Have tried the Google Group - but its held for moderation. And GGroups has a known issue that group owners arent notified of pending messages :( –  barryhunter Feb 6 '12 at 16:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.