Question

Glassfish 3.1.2, Mojarra 2.1.6, SSL activated

I have an question about static resource caching. I´ve read some posts about this but I´m not sure which options we should use. This

https://developers.google.com/speed/docs/best-practices/caching

is also an good article about resource caching. Within our application server SSL is activated. We see that static resources (images, scripts, css) are not cached.

Here is my test filter:

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    if (request instanceof HttpServletRequest && response instanceof HttpServletResponse) {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        String uri = httpRequest.getRequestURI();
        if (GET_METHOD.equalsIgnoreCase(httpRequest.getMethod()) && uri.contains(ResourceHandler.RESOURCE_IDENTIFIER)) {
            httpResponse.setDateHeader("Expires", System.currentTimeMillis() + 2419200000L); // 1 month in future.
            httpResponse.setDateHeader("Last-Modified", System.currentTimeMillis() - 2419200000L); // 1 month in past.
            httpResponse.setHeader("Cache-Control", "public"); // Secure caching
        }
    }
    chain.doFilter(request, response);
}

• Expires: Ok. It´s an static resource that doesn´t change, so we set the expiration date one month in the future.
• Last Modified: Not sure. I´ve read that setting this to the past has also impaces on caching
• Cache-Control: Ok. Allow secure caching. Security impacts?

Are there any impacts with this settings? I´ve also read a lot of posts where caching should be disabled through an filter. The only problem I see is that users could have a problem on a new release. Styles and Scripts could be changed in the new release but the browser ignore the new one and use the files from cache.

Answer 1

You only need to set Cache-Control. The Expires and Last-Modified are already set by default ResourceHandler (and would override the values set by your filter). The Last-Modified must represent the last modified timestamp of the resource in question. You can obtain it by servletContext.getResource(path).openConnection().getLastModified(). But you don’t need to set it here anyway. Just let ResourceHandler handle.

As to versioning, just use resource libraries rightly. You can put a version folder matching regex pattern \d+(_\d+)* in the library folder and the ResourceHandler will serve the newest.

E.g.

/resources/libraryname/1_0/js/file.js
/resources/libraryname/1_1/js/file.js
/resources/libraryname/1_2/js/file.js

The following will then get the one from 1_2:

<h:outputScript library="libraryname" name="js/file.js" />