SlideShare une entreprise Scribd logo
1  sur  20
Fearless HTTP
 requests abuse




Luís Cipriani
@lfcipriani (twitter, linkedin, github, ...)
20o. GURU (2011-11-26) - Sao Paulo/Brazil
ME
Motivation




                                   http://www.youtube.com/watch?v=8FpigqfcvlM


              “REST implies doing SEVERAL
             HTTP requests, this is bad, doesn’t
                  scale, blah blah blah...”
Motivation




                                   http://www.youtube.com/watch?v=8FpigqfcvlM



                Shut UP! Don’t think like that!
             SEVERAL people already solved this
                  problem SEVERAL ways.
Motivation




                                http://www.youtube.com/watch?v=8FpigqfcvlM




             One of the ways is HTTP cache
http cache BENEFITS




    • reduce bandwidth
    • reduce latency
    • reduce server load
    • hide network failures
http cache LOCALIZATION
http cache HEADERS




                     11 headers +15 directives
http cache FLOW




    1. may I cache?
    2. if it’s cached, is it fresh?
    3. if stale, is it valid on server?
    4. anything else I need to know?




                                          11+15
http cache 1. POSSO CACHEAR?



  cache-control                                                             should revalidate,
                     may I cache locally?     may I cache anywhere?
    directive                                                               even being fresh?


    no-store                no                        no                         n/a
       private              yes                       no                         no
   no-cache                 yes                       yes                        yes
        public              yes                       yes                        no
 1. locally means a cache that servers only one consumer
 2. these directives override any configuration of the cache
 3. by default, we can cache non safe/authenticated requests, GET and HEAD and
 those with status code 200, 203, 206, 300, 301, 410




                                                                                                 10 +11
http cache 2. IF IT IS CACHED, IS IT FRESH?



    the server should send the expiration time of
    an answer

        Expires: [RFC 1123 date]
        Cache-Control: max-age=600




    but if the server didn’t do this, cache may
    assign heuristically the expiration time.


                                                    9 +10
http cache 2. IF IT IS CACHED, IS IT FRESH?


  Age calculation




                                              7 +10
http cache 2. IF IT IS CACHED, IS IT FRESH?

 freshness_lifetime = Cache-Control: max-age | |   Expires -   Date
 response_is_fresh = freshness_lifetime >    Age




                                                                      7+7
http cache 3. IF STALE, REVALIDATE


    Validators
              Last-Modified                                                    ETag

    Conditionals
             If-Modified-Since                                          If-None-Match

                                     if conditional request == false



                                      304 Not Modified

         “... only return me a new resource if [conditional] applies on [validator] ...”

                                                                                           3+7
http cache 3.1. CONTROLLING REVALIDATION


   through client


        Cache-Control: no-cache +       Pragma: no-cache

        Cache-Control: max-age=0

        Cache-Control: only-if-cached




                                                           2+6
http cache 3.1. CONTROLLING REVALIDATION


   through origin server


         Cache-Control: must-revalidate
                                           after stale
         Cache-Control: proxy-revalidate

         Cache-Control: no-cache    always




                                                         2+4
http cache 4. WHAT ELSE SHOULD I KNOW?



    Vary   is part of cache key

                expired response, failed revalidation,
    Warning     advanced age (more than 24 hours)

                                                don’t allow transformation
    Cache-Control: no-transform                 on the content


    Cache-Control: extensions                   for example, channels


    Cache-Control: stale-if-error               availability over consistency


    Cache-Control: stale-while-revalidate                  background revalidation




                                                                                     0+0
http cache TIPS




     1. use URLs consistently
     2. common image library
     3. use cache for pages that changes in low frequency
     4. update cache with updated resources
     5. don’t change files unnecessarily
     6. use cookies only when necessary
     7. minimize the use of SSL
     8. validate your strategy on REDbot.org



                                         stolen from http://www.mnot.net/cache_docs/#TIPS

                                                                                 0+0
http cache REFERÊNCIAS




    1. http://en.wikipedia.org/wiki/Web_cache
    2. http://www.w3.org/Protocols/rfc2616/rfc2616.html
    3. http://www.mnot.net/cache_docs/
    4. http://redbot.org/
    5. http://www.mnot.net/blog/2008/01/04/cache_channels

    6. https://github.com/abril/cachebag




                                                            0+0
Reformulação Box de Login                            Abril ID

           http://abril-engineering-en.tumblr.com/




          FIM

Contenu connexe

En vedette

Explaining Semantic Web
Explaining Semantic WebExplaining Semantic Web
Explaining Semantic WebLuis Cipriani
 
Como um verdadeiro sistema REST funciona: arquitetura e performance na Abril
Como um verdadeiro sistema REST funciona: arquitetura e performance na AbrilComo um verdadeiro sistema REST funciona: arquitetura e performance na Abril
Como um verdadeiro sistema REST funciona: arquitetura e performance na AbrilLuis Cipriani
 
Rest services caching
Rest services cachingRest services caching
Rest services cachingSperasoft
 
"Опыт создания системы управления сборкой и тестированием" (слайдкаст)
"Опыт создания системы управления сборкой и тестированием" (слайдкаст)"Опыт создания системы управления сборкой и тестированием" (слайдкаст)
"Опыт создания системы управления сборкой и тестированием" (слайдкаст)SPB SQA Group
 
Corpakis wide slovenia6416
Corpakis wide slovenia6416Corpakis wide slovenia6416
Corpakis wide slovenia6416Dimitri Corpakis
 
Science.ppt [autosaved]
Science.ppt [autosaved]Science.ppt [autosaved]
Science.ppt [autosaved]MH BS
 
"Be the Thunder" Tampa Bay Lightning Case Study
"Be the Thunder" Tampa Bay Lightning Case Study"Be the Thunder" Tampa Bay Lightning Case Study
"Be the Thunder" Tampa Bay Lightning Case StudyJohn Luecke
 
Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...
Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...
Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...Yudi Lesmana
 
Marketingcharts Powerpoint The Marketing Data Box
Marketingcharts Powerpoint The Marketing Data BoxMarketingcharts Powerpoint The Marketing Data Box
Marketingcharts Powerpoint The Marketing Data BoxErgaro S.A. de C.V
 
Conhecendo os netbooks 2º A Prof Eliane
Conhecendo os netbooks 2º A Prof ElianeConhecendo os netbooks 2º A Prof Eliane
Conhecendo os netbooks 2º A Prof Elianedalvanice
 
Aliens in Our Uplands: Managing Past Mistakes, Preventing New Recruits
Aliens in Our Uplands: Managing Past Mistakes, Preventing New RecruitsAliens in Our Uplands: Managing Past Mistakes, Preventing New Recruits
Aliens in Our Uplands: Managing Past Mistakes, Preventing New RecruitsCary Institute of Ecosystem Studies
 
Wiki eindwerk cursist
Wiki eindwerk cursistWiki eindwerk cursist
Wiki eindwerk cursistCVO-SSH
 
Как попасть стартапу в СМИ
Как попасть стартапу в СМИКак попасть стартапу в СМИ
Как попасть стартапу в СМИalarin
 

En vedette (20)

Explaining Semantic Web
Explaining Semantic WebExplaining Semantic Web
Explaining Semantic Web
 
Como um verdadeiro sistema REST funciona: arquitetura e performance na Abril
Como um verdadeiro sistema REST funciona: arquitetura e performance na AbrilComo um verdadeiro sistema REST funciona: arquitetura e performance na Abril
Como um verdadeiro sistema REST funciona: arquitetura e performance na Abril
 
Rest services caching
Rest services cachingRest services caching
Rest services caching
 
Caching Strategies
Caching StrategiesCaching Strategies
Caching Strategies
 
"Опыт создания системы управления сборкой и тестированием" (слайдкаст)
"Опыт создания системы управления сборкой и тестированием" (слайдкаст)"Опыт создания системы управления сборкой и тестированием" (слайдкаст)
"Опыт создания системы управления сборкой и тестированием" (слайдкаст)
 
Corpakis wide slovenia6416
Corpakis wide slovenia6416Corpakis wide slovenia6416
Corpakis wide slovenia6416
 
Science.ppt [autosaved]
Science.ppt [autosaved]Science.ppt [autosaved]
Science.ppt [autosaved]
 
Good deedstalk leic_2013-06-11
Good deedstalk leic_2013-06-11Good deedstalk leic_2013-06-11
Good deedstalk leic_2013-06-11
 
Economic and Policy Impacts of Climate Change
Economic and Policy Impacts of Climate ChangeEconomic and Policy Impacts of Climate Change
Economic and Policy Impacts of Climate Change
 
Pecha kucha
Pecha kucha Pecha kucha
Pecha kucha
 
"Be the Thunder" Tampa Bay Lightning Case Study
"Be the Thunder" Tampa Bay Lightning Case Study"Be the Thunder" Tampa Bay Lightning Case Study
"Be the Thunder" Tampa Bay Lightning Case Study
 
Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...
Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...
Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...
 
Marketingcharts Powerpoint The Marketing Data Box
Marketingcharts Powerpoint The Marketing Data BoxMarketingcharts Powerpoint The Marketing Data Box
Marketingcharts Powerpoint The Marketing Data Box
 
Skills for a green economy
Skills for a green economySkills for a green economy
Skills for a green economy
 
Conhecendo os netbooks 2º A Prof Eliane
Conhecendo os netbooks 2º A Prof ElianeConhecendo os netbooks 2º A Prof Eliane
Conhecendo os netbooks 2º A Prof Eliane
 
Aliens in Our Uplands: Managing Past Mistakes, Preventing New Recruits
Aliens in Our Uplands: Managing Past Mistakes, Preventing New RecruitsAliens in Our Uplands: Managing Past Mistakes, Preventing New Recruits
Aliens in Our Uplands: Managing Past Mistakes, Preventing New Recruits
 
cvBarisGomleksizoglu-eng
cvBarisGomleksizoglu-engcvBarisGomleksizoglu-eng
cvBarisGomleksizoglu-eng
 
Wiki eindwerk cursist
Wiki eindwerk cursistWiki eindwerk cursist
Wiki eindwerk cursist
 
Global C Cycle with Role of Inland Waters
Global C Cycle with Role of Inland WatersGlobal C Cycle with Role of Inland Waters
Global C Cycle with Role of Inland Waters
 
Как попасть стартапу в СМИ
Как попасть стартапу в СМИКак попасть стартапу в СМИ
Как попасть стартапу в СМИ
 

Similaire à Fearless HTTP requests abuse

cache concepts and varnish-cache
cache concepts and varnish-cachecache concepts and varnish-cache
cache concepts and varnish-cacheMarc Cortinas Val
 
Caching in Drupal 8
Caching in Drupal 8Caching in Drupal 8
Caching in Drupal 8valuebound
 
Content Caching with NGINX and NGINX Plus
Content Caching with NGINX and NGINX PlusContent Caching with NGINX and NGINX Plus
Content Caching with NGINX and NGINX PlusKevin Jones
 
Varnish Cache Plus. Random notes for wise web developers
Varnish Cache Plus. Random notes for wise web developersVarnish Cache Plus. Random notes for wise web developers
Varnish Cache Plus. Random notes for wise web developersCarlos Abalde
 
Building an Impenetrable ZooKeeper - Kathleen Ting
Building an Impenetrable ZooKeeper - Kathleen TingBuilding an Impenetrable ZooKeeper - Kathleen Ting
Building an Impenetrable ZooKeeper - Kathleen Tingjaxconf
 
Accelerating Rails with edge caching
Accelerating Rails with edge cachingAccelerating Rails with edge caching
Accelerating Rails with edge cachingMichael May
 
Http caching 101 and a bit of CacheCow
Http caching 101 and a bit of CacheCowHttp caching 101 and a bit of CacheCow
Http caching 101 and a bit of CacheCowAli Kheyrollahi
 
NGINX High-performance Caching
NGINX High-performance CachingNGINX High-performance Caching
NGINX High-performance CachingNGINX, Inc.
 
REST in ( a mobile ) peace @ WHYMCA 05-21-2011
REST in ( a mobile ) peace @ WHYMCA 05-21-2011REST in ( a mobile ) peace @ WHYMCA 05-21-2011
REST in ( a mobile ) peace @ WHYMCA 05-21-2011Alessandro Nadalin
 
Nginx Scalable Stack
Nginx Scalable StackNginx Scalable Stack
Nginx Scalable StackBruno Paiuca
 
Hard Caching in TYPO3 - Developer Days in Malmø 2017
Hard Caching in TYPO3 - Developer Days in Malmø 2017Hard Caching in TYPO3 - Developer Days in Malmø 2017
Hard Caching in TYPO3 - Developer Days in Malmø 2017Benni Mack
 
Rails Caching: Secrets From the Edge
Rails Caching: Secrets From the EdgeRails Caching: Secrets From the Edge
Rails Caching: Secrets From the EdgeFastly
 
Rails Caching Secrets from the Edge
Rails Caching Secrets from the EdgeRails Caching Secrets from the Edge
Rails Caching Secrets from the EdgeMichael May
 
Caching the Uncacheable
Caching the UncacheableCaching the Uncacheable
Caching the Uncacheabledanrot
 

Similaire à Fearless HTTP requests abuse (20)

cache concepts and varnish-cache
cache concepts and varnish-cachecache concepts and varnish-cache
cache concepts and varnish-cache
 
Caching in Drupal 8
Caching in Drupal 8Caching in Drupal 8
Caching in Drupal 8
 
Content Caching with NGINX and NGINX Plus
Content Caching with NGINX and NGINX PlusContent Caching with NGINX and NGINX Plus
Content Caching with NGINX and NGINX Plus
 
Varnish Cache Plus. Random notes for wise web developers
Varnish Cache Plus. Random notes for wise web developersVarnish Cache Plus. Random notes for wise web developers
Varnish Cache Plus. Random notes for wise web developers
 
Alfresco tuning part2
Alfresco tuning part2Alfresco tuning part2
Alfresco tuning part2
 
Cache is King
Cache is KingCache is King
Cache is King
 
Varnish –Http Accelerator
Varnish –Http AcceleratorVarnish –Http Accelerator
Varnish –Http Accelerator
 
Building an Impenetrable ZooKeeper - Kathleen Ting
Building an Impenetrable ZooKeeper - Kathleen TingBuilding an Impenetrable ZooKeeper - Kathleen Ting
Building an Impenetrable ZooKeeper - Kathleen Ting
 
Accelerating Rails with edge caching
Accelerating Rails with edge cachingAccelerating Rails with edge caching
Accelerating Rails with edge caching
 
Http caching 101 and a bit of CacheCow
Http caching 101 and a bit of CacheCowHttp caching 101 and a bit of CacheCow
Http caching 101 and a bit of CacheCow
 
NGINX High-performance Caching
NGINX High-performance CachingNGINX High-performance Caching
NGINX High-performance Caching
 
REST in ( a mobile ) peace @ WHYMCA 05-21-2011
REST in ( a mobile ) peace @ WHYMCA 05-21-2011REST in ( a mobile ) peace @ WHYMCA 05-21-2011
REST in ( a mobile ) peace @ WHYMCA 05-21-2011
 
Nginx Scalable Stack
Nginx Scalable StackNginx Scalable Stack
Nginx Scalable Stack
 
Hard Caching in TYPO3 - Developer Days in Malmø 2017
Hard Caching in TYPO3 - Developer Days in Malmø 2017Hard Caching in TYPO3 - Developer Days in Malmø 2017
Hard Caching in TYPO3 - Developer Days in Malmø 2017
 
Rails Caching: Secrets From the Edge
Rails Caching: Secrets From the EdgeRails Caching: Secrets From the Edge
Rails Caching: Secrets From the Edge
 
Rails Caching Secrets from the Edge
Rails Caching Secrets from the EdgeRails Caching Secrets from the Edge
Rails Caching Secrets from the Edge
 
Caching in HTTP
Caching in HTTPCaching in HTTP
Caching in HTTP
 
Mini-Training: To cache or not to cache
Mini-Training: To cache or not to cacheMini-Training: To cache or not to cache
Mini-Training: To cache or not to cache
 
Caching the Uncacheable
Caching the UncacheableCaching the Uncacheable
Caching the Uncacheable
 
Caching. api. http 1.1
Caching. api. http 1.1Caching. api. http 1.1
Caching. api. http 1.1
 

Plus de Luis Cipriani

Adventures with Raspberry Pi and Twitter API
Adventures with Raspberry Pi and Twitter APIAdventures with Raspberry Pi and Twitter API
Adventures with Raspberry Pi and Twitter APILuis Cipriani
 
Capturando o pulso do planeta com as APIs de Streaming do Twitter
Capturando o pulso do planeta com as APIs de Streaming do TwitterCapturando o pulso do planeta com as APIs de Streaming do Twitter
Capturando o pulso do planeta com as APIs de Streaming do TwitterLuis Cipriani
 
Twitter e suas APIs de Streaming - Campus Party Brasil 7
Twitter e suas APIs de Streaming - Campus Party Brasil 7Twitter e suas APIs de Streaming - Campus Party Brasil 7
Twitter e suas APIs de Streaming - Campus Party Brasil 7Luis Cipriani
 
Segurança de APIs HTTP, um guia sensato para desenvolvedores preocupados
Segurança de APIs HTTP, um guia sensato para desenvolvedores preocupadosSegurança de APIs HTTP, um guia sensato para desenvolvedores preocupados
Segurança de APIs HTTP, um guia sensato para desenvolvedores preocupadosLuis Cipriani
 
Explaining A Programming Model for Context-Aware Applications in Large-Scale ...
Explaining A Programming Model for Context-Aware Applications in Large-Scale ...Explaining A Programming Model for Context-Aware Applications in Large-Scale ...
Explaining A Programming Model for Context-Aware Applications in Large-Scale ...Luis Cipriani
 
Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...
Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...
Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...Luis Cipriani
 

Plus de Luis Cipriani (6)

Adventures with Raspberry Pi and Twitter API
Adventures with Raspberry Pi and Twitter APIAdventures with Raspberry Pi and Twitter API
Adventures with Raspberry Pi and Twitter API
 
Capturando o pulso do planeta com as APIs de Streaming do Twitter
Capturando o pulso do planeta com as APIs de Streaming do TwitterCapturando o pulso do planeta com as APIs de Streaming do Twitter
Capturando o pulso do planeta com as APIs de Streaming do Twitter
 
Twitter e suas APIs de Streaming - Campus Party Brasil 7
Twitter e suas APIs de Streaming - Campus Party Brasil 7Twitter e suas APIs de Streaming - Campus Party Brasil 7
Twitter e suas APIs de Streaming - Campus Party Brasil 7
 
Segurança de APIs HTTP, um guia sensato para desenvolvedores preocupados
Segurança de APIs HTTP, um guia sensato para desenvolvedores preocupadosSegurança de APIs HTTP, um guia sensato para desenvolvedores preocupados
Segurança de APIs HTTP, um guia sensato para desenvolvedores preocupados
 
Explaining A Programming Model for Context-Aware Applications in Large-Scale ...
Explaining A Programming Model for Context-Aware Applications in Large-Scale ...Explaining A Programming Model for Context-Aware Applications in Large-Scale ...
Explaining A Programming Model for Context-Aware Applications in Large-Scale ...
 
Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...
Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...
Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...
 

Dernier

GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationMichael W. Hawkins
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityPrincipled Technologies
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationRadu Cotescu
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdflior mazor
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024The Digital Insurer
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProduct Anonymous
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)Gabriella Davis
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j
 
🐬 The future of MySQL is Postgres 🐘
🐬  The future of MySQL is Postgres   🐘🐬  The future of MySQL is Postgres   🐘
🐬 The future of MySQL is Postgres 🐘RTylerCroy
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilV3cube
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)wesley chun
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024The Digital Insurer
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Scriptwesley chun
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptxHampshireHUG
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slidevu2urc
 

Dernier (20)

GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
🐬 The future of MySQL is Postgres 🐘
🐬  The future of MySQL is Postgres   🐘🐬  The future of MySQL is Postgres   🐘
🐬 The future of MySQL is Postgres 🐘
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of Brazil
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 

Fearless HTTP requests abuse

  • 1. Fearless HTTP requests abuse Luís Cipriani @lfcipriani (twitter, linkedin, github, ...) 20o. GURU (2011-11-26) - Sao Paulo/Brazil
  • 2. ME
  • 3. Motivation http://www.youtube.com/watch?v=8FpigqfcvlM “REST implies doing SEVERAL HTTP requests, this is bad, doesn’t scale, blah blah blah...”
  • 4. Motivation http://www.youtube.com/watch?v=8FpigqfcvlM Shut UP! Don’t think like that! SEVERAL people already solved this problem SEVERAL ways.
  • 5. Motivation http://www.youtube.com/watch?v=8FpigqfcvlM One of the ways is HTTP cache
  • 6. http cache BENEFITS • reduce bandwidth • reduce latency • reduce server load • hide network failures
  • 8. http cache HEADERS 11 headers +15 directives
  • 9. http cache FLOW 1. may I cache? 2. if it’s cached, is it fresh? 3. if stale, is it valid on server? 4. anything else I need to know? 11+15
  • 10. http cache 1. POSSO CACHEAR? cache-control should revalidate, may I cache locally? may I cache anywhere? directive even being fresh? no-store no no n/a private yes no no no-cache yes yes yes public yes yes no 1. locally means a cache that servers only one consumer 2. these directives override any configuration of the cache 3. by default, we can cache non safe/authenticated requests, GET and HEAD and those with status code 200, 203, 206, 300, 301, 410 10 +11
  • 11. http cache 2. IF IT IS CACHED, IS IT FRESH? the server should send the expiration time of an answer Expires: [RFC 1123 date] Cache-Control: max-age=600 but if the server didn’t do this, cache may assign heuristically the expiration time. 9 +10
  • 12. http cache 2. IF IT IS CACHED, IS IT FRESH? Age calculation 7 +10
  • 13. http cache 2. IF IT IS CACHED, IS IT FRESH? freshness_lifetime = Cache-Control: max-age | | Expires - Date response_is_fresh = freshness_lifetime > Age 7+7
  • 14. http cache 3. IF STALE, REVALIDATE Validators Last-Modified ETag Conditionals If-Modified-Since If-None-Match if conditional request == false 304 Not Modified “... only return me a new resource if [conditional] applies on [validator] ...” 3+7
  • 15. http cache 3.1. CONTROLLING REVALIDATION through client Cache-Control: no-cache + Pragma: no-cache Cache-Control: max-age=0 Cache-Control: only-if-cached 2+6
  • 16. http cache 3.1. CONTROLLING REVALIDATION through origin server Cache-Control: must-revalidate after stale Cache-Control: proxy-revalidate Cache-Control: no-cache always 2+4
  • 17. http cache 4. WHAT ELSE SHOULD I KNOW? Vary is part of cache key expired response, failed revalidation, Warning advanced age (more than 24 hours) don’t allow transformation Cache-Control: no-transform on the content Cache-Control: extensions for example, channels Cache-Control: stale-if-error availability over consistency Cache-Control: stale-while-revalidate background revalidation 0+0
  • 18. http cache TIPS 1. use URLs consistently 2. common image library 3. use cache for pages that changes in low frequency 4. update cache with updated resources 5. don’t change files unnecessarily 6. use cookies only when necessary 7. minimize the use of SSL 8. validate your strategy on REDbot.org stolen from http://www.mnot.net/cache_docs/#TIPS 0+0
  • 19. http cache REFERÊNCIAS 1. http://en.wikipedia.org/wiki/Web_cache 2. http://www.w3.org/Protocols/rfc2616/rfc2616.html 3. http://www.mnot.net/cache_docs/ 4. http://redbot.org/ 5. http://www.mnot.net/blog/2008/01/04/cache_channels 6. https://github.com/abril/cachebag 0+0
  • 20. Reformulação Box de Login Abril ID http://abril-engineering-en.tumblr.com/ FIM

Notes de l'éditeur

  1. \n
  2. \n
  3. \n
  4. \n
  5. \n
  6. \n
  7. \n
  8. \n
  9. \n
  10. \n
  11. \n
  12. \n
  13. \n
  14. \n
  15. \n
  16. \n
  17. \n
  18. \n
  19. \n
  20. \n