SlideShare a Scribd company logo
Fearless HTTP
 requests abuse




Luís Cipriani
@lfcipriani (twitter, linkedin, github, ...)
20o. GURU (2011-11-26) - Sao Paulo/Brazil
ME
Motivation




                                   http://www.youtube.com/watch?v=8FpigqfcvlM


              “REST implies doing SEVERAL
             HTTP requests, this is bad, doesn’t
                  scale, blah blah blah...”
Motivation




                                   http://www.youtube.com/watch?v=8FpigqfcvlM



                Shut UP! Don’t think like that!
             SEVERAL people already solved this
                  problem SEVERAL ways.
Motivation




                                http://www.youtube.com/watch?v=8FpigqfcvlM




             One of the ways is HTTP cache
http cache BENEFITS




    • reduce bandwidth
    • reduce latency
    • reduce server load
    • hide network failures
http cache LOCALIZATION
http cache HEADERS




                     11 headers +15 directives
http cache FLOW




    1. may I cache?
    2. if it’s cached, is it fresh?
    3. if stale, is it valid on server?
    4. anything else I need to know?




                                          11+15
http cache 1. POSSO CACHEAR?



  cache-control                                                             should revalidate,
                     may I cache locally?     may I cache anywhere?
    directive                                                               even being fresh?


    no-store                no                        no                         n/a
       private              yes                       no                         no
   no-cache                 yes                       yes                        yes
        public              yes                       yes                        no
 1. locally means a cache that servers only one consumer
 2. these directives override any configuration of the cache
 3. by default, we can cache non safe/authenticated requests, GET and HEAD and
 those with status code 200, 203, 206, 300, 301, 410




                                                                                                 10 +11
http cache 2. IF IT IS CACHED, IS IT FRESH?



    the server should send the expiration time of
    an answer

        Expires: [RFC 1123 date]
        Cache-Control: max-age=600




    but if the server didn’t do this, cache may
    assign heuristically the expiration time.


                                                    9 +10
http cache 2. IF IT IS CACHED, IS IT FRESH?


  Age calculation




                                              7 +10
http cache 2. IF IT IS CACHED, IS IT FRESH?

 freshness_lifetime = Cache-Control: max-age | |   Expires -   Date
 response_is_fresh = freshness_lifetime >    Age




                                                                      7+7
http cache 3. IF STALE, REVALIDATE


    Validators
              Last-Modified                                                    ETag

    Conditionals
             If-Modified-Since                                          If-None-Match

                                     if conditional request == false



                                      304 Not Modified

         “... only return me a new resource if [conditional] applies on [validator] ...”

                                                                                           3+7
http cache 3.1. CONTROLLING REVALIDATION


   through client


        Cache-Control: no-cache +       Pragma: no-cache

        Cache-Control: max-age=0

        Cache-Control: only-if-cached




                                                           2+6
http cache 3.1. CONTROLLING REVALIDATION


   through origin server


         Cache-Control: must-revalidate
                                           after stale
         Cache-Control: proxy-revalidate

         Cache-Control: no-cache    always




                                                         2+4
http cache 4. WHAT ELSE SHOULD I KNOW?



    Vary   is part of cache key

                expired response, failed revalidation,
    Warning     advanced age (more than 24 hours)

                                                don’t allow transformation
    Cache-Control: no-transform                 on the content


    Cache-Control: extensions                   for example, channels


    Cache-Control: stale-if-error               availability over consistency


    Cache-Control: stale-while-revalidate                  background revalidation




                                                                                     0+0
http cache TIPS




     1. use URLs consistently
     2. common image library
     3. use cache for pages that changes in low frequency
     4. update cache with updated resources
     5. don’t change files unnecessarily
     6. use cookies only when necessary
     7. minimize the use of SSL
     8. validate your strategy on REDbot.org



                                         stolen from http://www.mnot.net/cache_docs/#TIPS

                                                                                 0+0
http cache REFERÊNCIAS




    1. http://en.wikipedia.org/wiki/Web_cache
    2. http://www.w3.org/Protocols/rfc2616/rfc2616.html
    3. http://www.mnot.net/cache_docs/
    4. http://redbot.org/
    5. http://www.mnot.net/blog/2008/01/04/cache_channels

    6. https://github.com/abril/cachebag




                                                            0+0
Reformulação Box de Login                            Abril ID

           http://abril-engineering-en.tumblr.com/




          FIM

More Related Content

Viewers also liked

Explaining Semantic Web
Explaining Semantic WebExplaining Semantic Web
Explaining Semantic Web
Luis Cipriani
 
Como um verdadeiro sistema REST funciona: arquitetura e performance na Abril
Como um verdadeiro sistema REST funciona: arquitetura e performance na AbrilComo um verdadeiro sistema REST funciona: arquitetura e performance na Abril
Como um verdadeiro sistema REST funciona: arquitetura e performance na Abril
Luis Cipriani
 
Rest services caching
Rest services cachingRest services caching
Rest services caching
Sperasoft
 
Caching Strategies
Caching StrategiesCaching Strategies
Caching Strategies
Michal Špaček
 
"Опыт создания системы управления сборкой и тестированием" (слайдкаст)
"Опыт создания системы управления сборкой и тестированием" (слайдкаст)"Опыт создания системы управления сборкой и тестированием" (слайдкаст)
"Опыт создания системы управления сборкой и тестированием" (слайдкаст)
SPB SQA Group
 
Corpakis wide slovenia6416
Corpakis wide slovenia6416Corpakis wide slovenia6416
Corpakis wide slovenia6416
Dimitri Corpakis
 
Science.ppt [autosaved]
Science.ppt [autosaved]Science.ppt [autosaved]
Science.ppt [autosaved]
MH BS
 
Economic and Policy Impacts of Climate Change
Economic and Policy Impacts of Climate ChangeEconomic and Policy Impacts of Climate Change
Economic and Policy Impacts of Climate Change
Cary Institute of Ecosystem Studies
 
"Be the Thunder" Tampa Bay Lightning Case Study
"Be the Thunder" Tampa Bay Lightning Case Study"Be the Thunder" Tampa Bay Lightning Case Study
"Be the Thunder" Tampa Bay Lightning Case Study
John Luecke
 
Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...
Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...
Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...
Yudi Lesmana
 
Marketingcharts Powerpoint The Marketing Data Box
Marketingcharts Powerpoint The Marketing Data BoxMarketingcharts Powerpoint The Marketing Data Box
Marketingcharts Powerpoint The Marketing Data BoxErgaro S.A. de C.V
 
Conhecendo os netbooks 2º A Prof Eliane
Conhecendo os netbooks 2º A Prof ElianeConhecendo os netbooks 2º A Prof Eliane
Conhecendo os netbooks 2º A Prof Elianedalvanice
 
Aliens in Our Uplands: Managing Past Mistakes, Preventing New Recruits
Aliens in Our Uplands: Managing Past Mistakes, Preventing New RecruitsAliens in Our Uplands: Managing Past Mistakes, Preventing New Recruits
Aliens in Our Uplands: Managing Past Mistakes, Preventing New Recruits
Cary Institute of Ecosystem Studies
 
Wiki eindwerk cursist
Wiki eindwerk cursistWiki eindwerk cursist
Wiki eindwerk cursistCVO-SSH
 
Global C Cycle with Role of Inland Waters
Global C Cycle with Role of Inland WatersGlobal C Cycle with Role of Inland Waters
Global C Cycle with Role of Inland Waters
Cary Institute of Ecosystem Studies
 
Как попасть стартапу в СМИ
Как попасть стартапу в СМИКак попасть стартапу в СМИ
Как попасть стартапу в СМИ
alarin
 

Viewers also liked (20)

Explaining Semantic Web
Explaining Semantic WebExplaining Semantic Web
Explaining Semantic Web
 
Como um verdadeiro sistema REST funciona: arquitetura e performance na Abril
Como um verdadeiro sistema REST funciona: arquitetura e performance na AbrilComo um verdadeiro sistema REST funciona: arquitetura e performance na Abril
Como um verdadeiro sistema REST funciona: arquitetura e performance na Abril
 
Rest services caching
Rest services cachingRest services caching
Rest services caching
 
Caching Strategies
Caching StrategiesCaching Strategies
Caching Strategies
 
"Опыт создания системы управления сборкой и тестированием" (слайдкаст)
"Опыт создания системы управления сборкой и тестированием" (слайдкаст)"Опыт создания системы управления сборкой и тестированием" (слайдкаст)
"Опыт создания системы управления сборкой и тестированием" (слайдкаст)
 
Corpakis wide slovenia6416
Corpakis wide slovenia6416Corpakis wide slovenia6416
Corpakis wide slovenia6416
 
Science.ppt [autosaved]
Science.ppt [autosaved]Science.ppt [autosaved]
Science.ppt [autosaved]
 
Good deedstalk leic_2013-06-11
Good deedstalk leic_2013-06-11Good deedstalk leic_2013-06-11
Good deedstalk leic_2013-06-11
 
Economic and Policy Impacts of Climate Change
Economic and Policy Impacts of Climate ChangeEconomic and Policy Impacts of Climate Change
Economic and Policy Impacts of Climate Change
 
Pecha kucha
Pecha kucha Pecha kucha
Pecha kucha
 
"Be the Thunder" Tampa Bay Lightning Case Study
"Be the Thunder" Tampa Bay Lightning Case Study"Be the Thunder" Tampa Bay Lightning Case Study
"Be the Thunder" Tampa Bay Lightning Case Study
 
Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...
Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...
Dominasi tim kpc memory sports indonesia di kejuaraan daya ingat internasiona...
 
Marketingcharts Powerpoint The Marketing Data Box
Marketingcharts Powerpoint The Marketing Data BoxMarketingcharts Powerpoint The Marketing Data Box
Marketingcharts Powerpoint The Marketing Data Box
 
Skills for a green economy
Skills for a green economySkills for a green economy
Skills for a green economy
 
Conhecendo os netbooks 2º A Prof Eliane
Conhecendo os netbooks 2º A Prof ElianeConhecendo os netbooks 2º A Prof Eliane
Conhecendo os netbooks 2º A Prof Eliane
 
Aliens in Our Uplands: Managing Past Mistakes, Preventing New Recruits
Aliens in Our Uplands: Managing Past Mistakes, Preventing New RecruitsAliens in Our Uplands: Managing Past Mistakes, Preventing New Recruits
Aliens in Our Uplands: Managing Past Mistakes, Preventing New Recruits
 
cvBarisGomleksizoglu-eng
cvBarisGomleksizoglu-engcvBarisGomleksizoglu-eng
cvBarisGomleksizoglu-eng
 
Wiki eindwerk cursist
Wiki eindwerk cursistWiki eindwerk cursist
Wiki eindwerk cursist
 
Global C Cycle with Role of Inland Waters
Global C Cycle with Role of Inland WatersGlobal C Cycle with Role of Inland Waters
Global C Cycle with Role of Inland Waters
 
Как попасть стартапу в СМИ
Как попасть стартапу в СМИКак попасть стартапу в СМИ
Как попасть стартапу в СМИ
 

Similar to Fearless HTTP requests abuse

cache concepts and varnish-cache
cache concepts and varnish-cachecache concepts and varnish-cache
cache concepts and varnish-cache
Marc Cortinas Val
 
Caching in Drupal 8
Caching in Drupal 8Caching in Drupal 8
Caching in Drupal 8
valuebound
 
Content Caching with NGINX and NGINX Plus
Content Caching with NGINX and NGINX PlusContent Caching with NGINX and NGINX Plus
Content Caching with NGINX and NGINX Plus
Kevin Jones
 
Varnish Cache Plus. Random notes for wise web developers
Varnish Cache Plus. Random notes for wise web developersVarnish Cache Plus. Random notes for wise web developers
Varnish Cache Plus. Random notes for wise web developers
Carlos Abalde
 
Alfresco tuning part2
Alfresco tuning part2Alfresco tuning part2
Alfresco tuning part2
Luis Cabaceira
 
Cache is King
Cache is KingCache is King
Cache is King
Steve Souders
 
Building an Impenetrable ZooKeeper - Kathleen Ting
Building an Impenetrable ZooKeeper - Kathleen TingBuilding an Impenetrable ZooKeeper - Kathleen Ting
Building an Impenetrable ZooKeeper - Kathleen Ting
jaxconf
 
Accelerating Rails with edge caching
Accelerating Rails with edge cachingAccelerating Rails with edge caching
Accelerating Rails with edge caching
Michael May
 
Http caching 101 and a bit of CacheCow
Http caching 101 and a bit of CacheCowHttp caching 101 and a bit of CacheCow
Http caching 101 and a bit of CacheCow
Ali Kheyrollahi
 
NGINX High-performance Caching
NGINX High-performance CachingNGINX High-performance Caching
NGINX High-performance Caching
NGINX, Inc.
 
REST in ( a mobile ) peace @ WHYMCA 05-21-2011
REST in ( a mobile ) peace @ WHYMCA 05-21-2011REST in ( a mobile ) peace @ WHYMCA 05-21-2011
REST in ( a mobile ) peace @ WHYMCA 05-21-2011
Alessandro Nadalin
 
Nginx Scalable Stack
Nginx Scalable StackNginx Scalable Stack
Nginx Scalable Stack
Bruno Paiuca
 
Hard Caching in TYPO3 - Developer Days in Malmø 2017
Hard Caching in TYPO3 - Developer Days in Malmø 2017Hard Caching in TYPO3 - Developer Days in Malmø 2017
Hard Caching in TYPO3 - Developer Days in Malmø 2017
Benni Mack
 
Rails Caching: Secrets From the Edge
Rails Caching: Secrets From the EdgeRails Caching: Secrets From the Edge
Rails Caching: Secrets From the Edge
Fastly
 
Rails Caching Secrets from the Edge
Rails Caching Secrets from the EdgeRails Caching Secrets from the Edge
Rails Caching Secrets from the Edge
Michael May
 
Caching in HTTP
Caching in HTTPCaching in HTTP
Caching in HTTP
Alexander Shopov
 
Mini-Training: To cache or not to cache
Mini-Training: To cache or not to cacheMini-Training: To cache or not to cache
Mini-Training: To cache or not to cache
Betclic Everest Group Tech Team
 
Caching the Uncacheable
Caching the UncacheableCaching the Uncacheable
Caching the Uncacheable
danrot
 
Caching. api. http 1.1
Caching. api. http 1.1Caching. api. http 1.1
Caching. api. http 1.1
Artjoker Digital
 

Similar to Fearless HTTP requests abuse (20)

cache concepts and varnish-cache
cache concepts and varnish-cachecache concepts and varnish-cache
cache concepts and varnish-cache
 
Caching in Drupal 8
Caching in Drupal 8Caching in Drupal 8
Caching in Drupal 8
 
Content Caching with NGINX and NGINX Plus
Content Caching with NGINX and NGINX PlusContent Caching with NGINX and NGINX Plus
Content Caching with NGINX and NGINX Plus
 
Varnish Cache Plus. Random notes for wise web developers
Varnish Cache Plus. Random notes for wise web developersVarnish Cache Plus. Random notes for wise web developers
Varnish Cache Plus. Random notes for wise web developers
 
Alfresco tuning part2
Alfresco tuning part2Alfresco tuning part2
Alfresco tuning part2
 
Cache is King
Cache is KingCache is King
Cache is King
 
Varnish –Http Accelerator
Varnish –Http AcceleratorVarnish –Http Accelerator
Varnish –Http Accelerator
 
Building an Impenetrable ZooKeeper - Kathleen Ting
Building an Impenetrable ZooKeeper - Kathleen TingBuilding an Impenetrable ZooKeeper - Kathleen Ting
Building an Impenetrable ZooKeeper - Kathleen Ting
 
Accelerating Rails with edge caching
Accelerating Rails with edge cachingAccelerating Rails with edge caching
Accelerating Rails with edge caching
 
Http caching 101 and a bit of CacheCow
Http caching 101 and a bit of CacheCowHttp caching 101 and a bit of CacheCow
Http caching 101 and a bit of CacheCow
 
NGINX High-performance Caching
NGINX High-performance CachingNGINX High-performance Caching
NGINX High-performance Caching
 
REST in ( a mobile ) peace @ WHYMCA 05-21-2011
REST in ( a mobile ) peace @ WHYMCA 05-21-2011REST in ( a mobile ) peace @ WHYMCA 05-21-2011
REST in ( a mobile ) peace @ WHYMCA 05-21-2011
 
Nginx Scalable Stack
Nginx Scalable StackNginx Scalable Stack
Nginx Scalable Stack
 
Hard Caching in TYPO3 - Developer Days in Malmø 2017
Hard Caching in TYPO3 - Developer Days in Malmø 2017Hard Caching in TYPO3 - Developer Days in Malmø 2017
Hard Caching in TYPO3 - Developer Days in Malmø 2017
 
Rails Caching: Secrets From the Edge
Rails Caching: Secrets From the EdgeRails Caching: Secrets From the Edge
Rails Caching: Secrets From the Edge
 
Rails Caching Secrets from the Edge
Rails Caching Secrets from the EdgeRails Caching Secrets from the Edge
Rails Caching Secrets from the Edge
 
Caching in HTTP
Caching in HTTPCaching in HTTP
Caching in HTTP
 
Mini-Training: To cache or not to cache
Mini-Training: To cache or not to cacheMini-Training: To cache or not to cache
Mini-Training: To cache or not to cache
 
Caching the Uncacheable
Caching the UncacheableCaching the Uncacheable
Caching the Uncacheable
 
Caching. api. http 1.1
Caching. api. http 1.1Caching. api. http 1.1
Caching. api. http 1.1
 

More from Luis Cipriani

Adventures with Raspberry Pi and Twitter API
Adventures with Raspberry Pi and Twitter APIAdventures with Raspberry Pi and Twitter API
Adventures with Raspberry Pi and Twitter API
Luis Cipriani
 
Capturando o pulso do planeta com as APIs de Streaming do Twitter
Capturando o pulso do planeta com as APIs de Streaming do TwitterCapturando o pulso do planeta com as APIs de Streaming do Twitter
Capturando o pulso do planeta com as APIs de Streaming do Twitter
Luis Cipriani
 
Twitter e suas APIs de Streaming - Campus Party Brasil 7
Twitter e suas APIs de Streaming - Campus Party Brasil 7Twitter e suas APIs de Streaming - Campus Party Brasil 7
Twitter e suas APIs de Streaming - Campus Party Brasil 7
Luis Cipriani
 
Segurança de APIs HTTP, um guia sensato para desenvolvedores preocupados
Segurança de APIs HTTP, um guia sensato para desenvolvedores preocupadosSegurança de APIs HTTP, um guia sensato para desenvolvedores preocupados
Segurança de APIs HTTP, um guia sensato para desenvolvedores preocupados
Luis Cipriani
 
Explaining A Programming Model for Context-Aware Applications in Large-Scale ...
Explaining A Programming Model for Context-Aware Applications in Large-Scale ...Explaining A Programming Model for Context-Aware Applications in Large-Scale ...
Explaining A Programming Model for Context-Aware Applications in Large-Scale ...
Luis Cipriani
 
Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...
Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...
Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...
Luis Cipriani
 

More from Luis Cipriani (6)

Adventures with Raspberry Pi and Twitter API
Adventures with Raspberry Pi and Twitter APIAdventures with Raspberry Pi and Twitter API
Adventures with Raspberry Pi and Twitter API
 
Capturando o pulso do planeta com as APIs de Streaming do Twitter
Capturando o pulso do planeta com as APIs de Streaming do TwitterCapturando o pulso do planeta com as APIs de Streaming do Twitter
Capturando o pulso do planeta com as APIs de Streaming do Twitter
 
Twitter e suas APIs de Streaming - Campus Party Brasil 7
Twitter e suas APIs de Streaming - Campus Party Brasil 7Twitter e suas APIs de Streaming - Campus Party Brasil 7
Twitter e suas APIs de Streaming - Campus Party Brasil 7
 
Segurança de APIs HTTP, um guia sensato para desenvolvedores preocupados
Segurança de APIs HTTP, um guia sensato para desenvolvedores preocupadosSegurança de APIs HTTP, um guia sensato para desenvolvedores preocupados
Segurança de APIs HTTP, um guia sensato para desenvolvedores preocupados
 
Explaining A Programming Model for Context-Aware Applications in Large-Scale ...
Explaining A Programming Model for Context-Aware Applications in Large-Scale ...Explaining A Programming Model for Context-Aware Applications in Large-Scale ...
Explaining A Programming Model for Context-Aware Applications in Large-Scale ...
 
Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...
Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...
Alexandria: um Sistema de Sistemas para Publicação de Conteúdo Digital utiliz...
 

Recently uploaded

Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
Ana-Maria Mihalceanu
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Inflectra
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
Laura Byrne
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Product School
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
Product School
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Albert Hoitingh
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
James Anderson
 
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Ramesh Iyer
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
Paul Groth
 
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdfSmart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
91mobiles
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
DianaGray10
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
DianaGray10
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
DianaGray10
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
Alison B. Lowndes
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance
 
Elevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object CalisthenicsElevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object Calisthenics
Dorra BARTAGUIZ
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
Alan Dix
 
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
Sri Ambati
 

Recently uploaded (20)

Monitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR EventsMonitoring Java Application Security with JDK Tools and JFR Events
Monitoring Java Application Security with JDK Tools and JFR Events
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
 
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
 
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdfSmart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
 
Elevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object CalisthenicsElevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object Calisthenics
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
 
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...
 

Fearless HTTP requests abuse

  • 1. Fearless HTTP requests abuse Luís Cipriani @lfcipriani (twitter, linkedin, github, ...) 20o. GURU (2011-11-26) - Sao Paulo/Brazil
  • 2. ME
  • 3. Motivation http://www.youtube.com/watch?v=8FpigqfcvlM “REST implies doing SEVERAL HTTP requests, this is bad, doesn’t scale, blah blah blah...”
  • 4. Motivation http://www.youtube.com/watch?v=8FpigqfcvlM Shut UP! Don’t think like that! SEVERAL people already solved this problem SEVERAL ways.
  • 5. Motivation http://www.youtube.com/watch?v=8FpigqfcvlM One of the ways is HTTP cache
  • 6. http cache BENEFITS • reduce bandwidth • reduce latency • reduce server load • hide network failures
  • 8. http cache HEADERS 11 headers +15 directives
  • 9. http cache FLOW 1. may I cache? 2. if it’s cached, is it fresh? 3. if stale, is it valid on server? 4. anything else I need to know? 11+15
  • 10. http cache 1. POSSO CACHEAR? cache-control should revalidate, may I cache locally? may I cache anywhere? directive even being fresh? no-store no no n/a private yes no no no-cache yes yes yes public yes yes no 1. locally means a cache that servers only one consumer 2. these directives override any configuration of the cache 3. by default, we can cache non safe/authenticated requests, GET and HEAD and those with status code 200, 203, 206, 300, 301, 410 10 +11
  • 11. http cache 2. IF IT IS CACHED, IS IT FRESH? the server should send the expiration time of an answer Expires: [RFC 1123 date] Cache-Control: max-age=600 but if the server didn’t do this, cache may assign heuristically the expiration time. 9 +10
  • 12. http cache 2. IF IT IS CACHED, IS IT FRESH? Age calculation 7 +10
  • 13. http cache 2. IF IT IS CACHED, IS IT FRESH? freshness_lifetime = Cache-Control: max-age | | Expires - Date response_is_fresh = freshness_lifetime > Age 7+7
  • 14. http cache 3. IF STALE, REVALIDATE Validators Last-Modified ETag Conditionals If-Modified-Since If-None-Match if conditional request == false 304 Not Modified “... only return me a new resource if [conditional] applies on [validator] ...” 3+7
  • 15. http cache 3.1. CONTROLLING REVALIDATION through client Cache-Control: no-cache + Pragma: no-cache Cache-Control: max-age=0 Cache-Control: only-if-cached 2+6
  • 16. http cache 3.1. CONTROLLING REVALIDATION through origin server Cache-Control: must-revalidate after stale Cache-Control: proxy-revalidate Cache-Control: no-cache always 2+4
  • 17. http cache 4. WHAT ELSE SHOULD I KNOW? Vary is part of cache key expired response, failed revalidation, Warning advanced age (more than 24 hours) don’t allow transformation Cache-Control: no-transform on the content Cache-Control: extensions for example, channels Cache-Control: stale-if-error availability over consistency Cache-Control: stale-while-revalidate background revalidation 0+0
  • 18. http cache TIPS 1. use URLs consistently 2. common image library 3. use cache for pages that changes in low frequency 4. update cache with updated resources 5. don’t change files unnecessarily 6. use cookies only when necessary 7. minimize the use of SSL 8. validate your strategy on REDbot.org stolen from http://www.mnot.net/cache_docs/#TIPS 0+0
  • 19. http cache REFERÊNCIAS 1. http://en.wikipedia.org/wiki/Web_cache 2. http://www.w3.org/Protocols/rfc2616/rfc2616.html 3. http://www.mnot.net/cache_docs/ 4. http://redbot.org/ 5. http://www.mnot.net/blog/2008/01/04/cache_channels 6. https://github.com/abril/cachebag 0+0
  • 20. Reformulação Box de Login Abril ID http://abril-engineering-en.tumblr.com/ FIM

Editor's Notes

  1. \n
  2. \n
  3. \n
  4. \n
  5. \n
  6. \n
  7. \n
  8. \n
  9. \n
  10. \n
  11. \n
  12. \n
  13. \n
  14. \n
  15. \n
  16. \n
  17. \n
  18. \n
  19. \n
  20. \n