Post mortem of a failed HackerNews launch

Re:Post mortem of a failed HackerNews launch by zorlem on Thursday November 29, 2012 @12:37PM (#4848986)

There was a cookie set for CSRF protection and the headers specify that content should not be cached if there is a cookie (or more precisely - the cached content includes the cookie as a cache key, so each request with a different cookie gets a cache-miss).

[ Parent | on HN ]

Re:Post mortem of a failed HackerNews launch by Cherian on Thursday November 29, 2012 @12:40PM (#4849018)

Slightly different.

"Note that in 0.8.44 behaviour was changed to something considered more natural. As of 0.8.44 nginx no longer caches responses with Set-Cookie header and doesn't strip this header with cache turned on (unless you instruct it to do so with proxy_hide_header and proxy_ignore_headers). "

http://forum.nginx.org/read.php?2,126312,126316#msg-126316

[ Parent | on HN ]

Re:Post mortem of a failed HackerNews launch by zorlem on Thursday November 29, 2012 @12:53PM (#4849112)

Thanks for the clarification.

[ Parent | on HN ]

Re:Post mortem of a failed HackerNews launch by alexbrand09 on Thursday November 29, 2012 @10:10PM (#4851637)

How would you circumvent this? I'm thinking that disabling CSRF is probably a bad idea. Maybe use AJAX to get the CSRF token after page load?

[ Parent | on HN ]

Re:Post mortem of a failed HackerNews launch by digitalpbk on Thursday November 29, 2012 @10:34PM (#4851698)

Developer here, since we had a click to open form at the time, we loaded the CSRF via AJAX. However that does not seem to be a good idea if we need it to work asap (and without javascript). I would look at something like SSI to put in the CSRF token to a cached page.

[ Parent | on HN ]