Pages and Strong ETags

Does Pages automatically generate strong ETags that we can configure as an Enterprise customer? We have a ton of ongoing cache issues related to weak ETags and CSP hashing where our app cannot be loaded by some users. We suspect it has to do with weak ETags being used rather than strong ETags.

I was reading through https://developers.cloudflare.com/cache/how-to/cache-rules/ which allows for strong ETags, but this implies that Cloudflare cache will respect Strong ETags served from the origin which for us is Cloudflare Pages. Hence the question if Cloudflare Pages will generate Strong ETags.

(Note that we are an enterprise customer)

Cache Rules (beta) · Cloudflare Cache (CDN) docs

Use Cache Rules to customize cache properties of your HTTP requests. For example, create a rule to specify how long to cache a resource in the …

zegevlier•10/11/23, 6:20 AM

Generally, you do not want to configure any additional caching over pages. It already handels caching for you. See https://developers.cloudflare.com/pages/platform/serving-pages/#caching-and-performance. Is there any specific reason you want to put additional caching over pages?

cryptomania | skiffOP•10/12/23, 11:04 PM

We generally have seen weak etags completely break our app

Ccryptomania | skiff We generally have seen weak etags completely break our app

Hello, I’m Allie!•10/13/23, 4:22 AM

If it doesn’t serve Etags and a Cache Control max-age of 0, then it shouldn’t break anything, no?

cryptomania | skiffOP•10/13/23, 4:42 AM

we use the integrity attribute in our JS chunks so the hash sometimes doesn't match up which causes issues. (SRI needs byte for byte matching but the actual JS that is loaded is some cached version that matches a weak etag but fails on the actual hashing)

Ccryptomania | skiff we use the integrity attribute in our JS chunks so the hash sometimes doesn't ma...

Hello, I’m Allie!•10/13/23, 5:17 AM

Does it work if there isn’t an ETag at all?

Hello, I’m Allie!•10/13/23, 5:17 AM

Because that is what CF Pages does by default

HHello, I’m Allie!Does it work if there isn’t an ETag at all?

cryptomania | skiffOP•10/13/23, 6:12 AM

But we aren't generating any ETags on our end? It seems like Pages is doing it. I can try and see if there was some button in the Cloudflare dashboard that we pushed to turn on weak etags

Ccryptomania | skiff But we aren't generating any ETags on our end? It seems like Pages is doing it. ...

Hello, I’m Allie!•10/13/23, 6:31 AM

I might be mistaken. Just to check, do you see ETags on https://www.goalastair.com?

Livin' on the Edge

A blog about the stuff I do. Some of it is fun, some of it is cool, but it is all me.

cryptomania | skiffOP•10/13/23, 6:35 AM

yup at the bottom

Hello, I’m Allie!•10/13/23, 6:37 AM

Wut

Hello, I’m Allie!•10/13/23, 6:37 AM

Odd

Ccryptomania | skiff yup at the bottom

Hello, I’m Allie!•10/13/23, 6:37 AM

Ok, well then I guess you would have to override each manually? I don’t think there are any rules that generate strong ETag headers…

Hello, I’m Allie!•10/13/23, 6:38 AM

Oh wait

Hello, I’m Allie!•10/13/23, 6:38 AM

Cache Rules maybe?

Hello, I’m Allie!•10/13/23, 6:39 AM

Or is that only for respecting strong etags, not generating them…

HHello, I’m Allie!Ok, well then I guess you would have to override each manually? I don’t **think*...

cryptomania | skiffOP•10/13/23, 6:39 AM

so there is

cryptomania | skiffOP•10/13/23, 6:39 AM

yup exactly

cryptomania | skiffOP•10/13/23, 6:39 AM

i just want cf pages to generate strong ETags....

Ccryptomania | skiff yup exactly

Hello, I’m Allie!•10/13/23, 6:39 AM

Yeah, so then I guess you can just pre-generate them, or have a function to do so.

Hello, I’m Allie!•10/13/23, 6:39 AM

Though, could also put this in #pages-feature-suggestions

cryptomania | skiffOP•10/13/23, 6:40 AM

but wouldn't the pages worker run before any other custom worker?

Ccryptomania | skiff but wouldn't the pages worker run before any other custom worker?

Hello, I’m Allie!•10/13/23, 6:40 AM

Not with Functions

cryptomania | skiffOP•10/13/23, 6:42 AM

ahh so something like this https://developers.cloudflare.com/pages/platform/functions/examples/cors-headers/ ?

Adding CORS headers · Cloudflare Pages docs

This example is a snippet from our Cloudflare Pages Template repo.

Ccryptomania | skiff ahh so something like this https://developers.cloudflare.com/pages/platform/func...

Hello, I’m Allie!•10/13/23, 6:44 AM

Yeah, so you would hardcode the strong etags ahead of time

HHello, I’m Allie!Yeah, so you would hardcode the strong etags ahead of time

cryptomania | skiffOP•10/13/23, 6:45 AM

yea so CI would have to calculate the etag ahead of time (could just use the same digest from SRI) and then upload the script to this function

cryptomania | skiffOP•10/13/23, 6:45 AM

oh damn we are going to get capped on usage so quickly

Ccryptomania | skiff oh damn we are going to get capped on usage so quickly

Hello, I’m Allie!•10/13/23, 6:46 AM

If you don’t have that many assets, you could handle it with _headers

cryptomania | skiffOP•10/13/23, 6:46 AM

It's hundreds of JS chunks

Hello, I’m Allie!•10/13/23, 6:47 AM

Ok, yeah that might not go well

cryptomania | skiffOP•10/13/23, 6:47 AM

we are on an enterprise plan. i'll see if we can swing something with the customer success team or with support

cryptomania | skiffOP•10/13/23, 6:48 AM

seems rather odd that SRI isn't well supported

cryptomania | skiffOP•10/14/23, 12:39 AM

Just an update for future viewers. The pages app itself generates strong ETags. The CDN side of things is what was downgrading from a strong ETag to a weak ETag

cryptomania | skiffOP•10/14/23, 12:40 AM

You can check this by curl’ing across your pages app domain and the main app domain. We can’t figure out why the CDN is downgrading to weak ETag even after following the support article for settings that force weak ETAg

Ccryptomania | skiff so there is

Hello, I’m Allie!•10/23/23, 7:22 PM

Sorry for pinging after this long. Just to check, did you try this one?

Hello, I’m Allie!•10/23/23, 7:23 PM

Just tried again with my website, and it seems to be working...

$ curl -I https://www.goalastair.com
HTTP/2 200
date: Mon, 23 Oct 2023 19:20:24 GMT
content-type: text/html; charset=utf-8
content-length: 8588
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "c0c35193b81d2417bed16bce01435337"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
report-to: ...
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: MISS
accept-ranges: bytes
set-cookie: ...
content-security-policy: ...
permissions-policy: ...
server: cloudflare
cf-ray: 81ac56531dfe10f3-CPH
alt-svc: h3=":443"; ma=86400

$ curl -I https://www.goalastair.com
HTTP/2 200
date: Mon, 23 Oct 2023 19:20:24 GMT
content-type: text/html; charset=utf-8
content-length: 8588
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: "c0c35193b81d2417bed16bce01435337"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
report-to: ...
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: MISS
accept-ranges: bytes
set-cookie: ...
content-security-policy: ...
permissions-policy: ...
server: cloudflare
cf-ray: 81ac56531dfe10f3-CPH
alt-svc: h3=":443"; ma=86400

$ curl -I https://www.goalastair.com HTTP/2 200 date: Mon, 23 Oct 2023 19:20:24 GMT content-type: text/html; charset=utf-8 content-length: 8588 access-control-allow-origin: * cache-control: public, max-age=0, must-revalidate etag: "c0c35193b81d2417bed16bce01435337" strict-transport-security: max-age=31536000 x-content-type-options: nosniff x-frame-options: DENY report-to: ... nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status: MISS accept-ranges: bytes set-cookie: ... content-security-policy: ... permissions-policy: ... server: cloudflare cf-ray: 81ac56531dfe10f3-CPH alt-svc: h3=":443"; ma=86400

Pages and Strong ETags

Similar Threads

Similar Threads

Similar Threads