HTTP Caching & Cache-Busting for Content Publishers
|
|
|
- Angelina Parker
- 8 years ago
- Views:
Transcription
1 HTTP Caching & Cache-Busting for Content Publishers Michael J. Radwin OSCON 2005 Thursday, August 4th,
2 Agenda HTTP in 3 minutes Caching concepts Hit, Miss, Revalidation 5 techniques for caching and cache-busting Not covered in this talk Proxy deployment HTTP acceleration (a k a reverse proxies) Database query results caching 2 Motivation: Publishers have a lot of web content HTML, images, Flash, movies Speed is important part of user experience Bandwidth is expensive Use what you need, but avoid unnecessary extra Personalization differentiates Show timely data (stock quotes, news stories) Get accurate advertising statistics Protect sensitive info ( , account balances) Not covered: Proxy deployment is an interesting subject and deserves an entire lecture by itself Configuring proxy cache servers (i.e. Squid) Configuring browsers to use proxy caches Transparent/interception proxy caching Intercache protocols (ICP, HTCP) 2
3 HTTP and Proxy Review 3 3
4 HTTP: Simple and elegant 1. Client connects to port 80 Client Server Internet 2. Client sends GET request Internet 4 4
5 HTTP: Simple and elegant 3. Server sends response Internet 4. Client closes connection Internet 5 5
6 HTTP example telnet 80 Trying Connected to w6.example.com. Escape character is '^]'. GET /foo/index.html HTTP/1.1 Host: HTTP/ OK Date: Wed, 28 Jul :36:12 GMT Last-Modified: Thu, 12 May :08:50 GMT Content-Length: 3688 Connection: close Content-Type: text/html <html><head> <title>hello World</title>
7 Browsers use private caches GET /foo/index.html HTTP/1.1 Host: HTTP/ OK Last-Modified: Thu, 12 May :08:50 GMT Content-Length: 3688 Content-Type: text/html Browser Cache 7 Client stores copy of on its hard disk with timestamp. 7
8 Revalidation (Conditional GET) GET /foo/index.html HTTP/1.1 Host: If-Modified-Since: Thu, 12 May :08:50 GMT HTTP/ Not Modified Revalidate using Last-Modified time 8 The presence of If-Modified-Since header is what makes this a Conditional GET. Sometimes called an IMS GET. If content had actually changed, server would simply reply with a 200 OK and send full content. 8
9 Non-Caching Proxy GET /foo/index.html HTTP/1.1 Host: Proxy GET /foo/index.html HTTP/1.1 Host: HTTP/ OK Last-Modified: Thu,... Content-Length: 3688 Content-Type: text/html HTTP/ OK Last-Modified: Thu,... Content-Length: 3688 Content-Type: text/html 9 9
10 Caching Proxy: Miss GET /foo/index.html HTTP/1.1 Host: Proxy GET /foo/index.html HTTP/1.1 Host: HTTP/ OK Last-Modified: Thu,... Content-Length: 3688 Content-Type: text/html HTTP/ OK Last-Modified: Thu,... Content-Length: 3688 Content-Type: text/html Proxy Cache (Saves copy) 10 10
11 Caching Proxy: Hit GET /foo/index.html HTTP/1.1 Host: Proxy HTTP/ OK Last-Modified: Thu,... Content-Length: 3688 Content-Type: text/html Proxy Cache (Fresh copy!) 11 11
12 Caching Proxy: Revalidation GET /foo/index.html HTTP/1.1 Host: Proxy GET /foo/index.html HTTP/1.1 Host: If-Modified-Since: Thu,... HTTP/ OK Last-Modified: Thu,... Content-Length: 3688 Content-Type: text/html HTTP/ Not Modified Proxy Cache (Stale copy) 12 12
13 Top 5 Caching Techniques 13 13
14 Assumptions about content types Rate of change once published Frequently Occasionally Rarely/Never HTML CSS JavaScript Images Flash PDF Dynamic Content Static Content Personalized Same for everyone 14 14
15 Top 5 techniques for publishers 1. Use Cache-Control: private for personalized content 2. Implement Images Never Expire policy 3. Use a cookie-free TLD for static content 4. Use Apache defaults for occasionallychanging static content 5. Use random tags in URL for accurate hit metering or very sensitive content 15 15
16 1. Cache-Control: private for personalized content Rate of change once published Frequently Occasionally Rarely/Never HTML CSS JavaScript Images Flash PDF Dynamic Content Static Content Personalized Same for everyone 16 16
17 Bad Caching: Jane s 1st visit The URL isn't all that matters GET /inbox?msg=3 HTTP/1.1 Host: webmail.example.com Cookie: user=jane Proxy GET /inbox?msg=3 HTTP/1.1 Host: webmail.example.com Cookie: user=jane HTTP/ OK Last-Modified: Thu,... Content-Type: text/html HTTP/ OK Last-Modified: Thu,... Content-Type: text/html Proxy Cache (Saves copy) 17 17
18 Bad Caching: Jane s 2nd visit Jane sees same message upon return GET /inbox?msg=3 HTTP/1.1 Host: webmail.example.com Cookie: user=jane Proxy HTTP/ OK Last-Modified: Thu,... Content-Type: text/html Proxy Cache (Fresh copy of Jane's) 18 18
19 Bad Caching: Mary s visit Witness a false positive cache hit GET /inbox?msg=3 HTTP/1.1 Host: webmail.example.com Cookie: user=mary Proxy HTTP/ OK Last-Modified: Thu,... Content-Type: text/html Proxy Cache (Fresh copy of Jane's) 19 19
20 What s cacheable? HTTP/1.1 allows caching anything by default Unless overridden with Cache-Control header In practice, most caches avoid anything with Cache-Control/Pragma header Cookie/Set-Cookie header WWW-Authenticate/Authorization header POST/PUT method 302/307 status code (redirects) SSL content Response Cacheability Unless specifically constrained by a cache-control (section 14.9) directive, a caching system MAY always store a successful response (see section 13.8) as a cache entry, MAY return it without validation if it is fresh, and MAY return it after successful validation. If there is neither a cache validator nor an explicit expiration time associated with a response, we do not expect it to be cached, but certain caches MAY violate this expectation (for example, when little or no network connectivity is available). A client can usually detect that such a response was taken from a cache by comparing the Date header to the current time. 20
21 Cache-Control: private Shared caches bad for shared content Mary shouldn t be able to read Jane s mail Private caches perfectly OK Speed up web browsing experience Avoid personalization leakage with single line in httpd.conf or.htaccess Header set Cache-Control private 21 Note that HTTP/1.0 proxies aren t expected to understand Cache-Control header. If you re really concerned about user information leakage and there s a possibility that your users are behind HTTP/1.0 proxies, use technique #5 (random strings in the URL). 21
22 2. Images Never Expire policy Rate of change once published Frequently Occasionally Rarely/Never HTML CSS JavaScript Images Flash PDF Dynamic Content Static Content Personalized Same for everyone 22 22
23 Images Never Expire Policy Dictate that images (icons, logos) once published never change Set Expires header 10 years in the future Use new names for new versions Tradeoffs More difficult for designers Faster user experience, bandwidth savings 23 Pushing images to a separate server typically means that designers can t use 1- click publishing solutions such as Microsoft Frontpage. 23
24 Imgs Never Expire: mod_expires # Works with both HTTP/1.0 and HTTP/1.1 # (10*365*24*60*60) = seconds ExpiresActive On ExpiresByType image/gif A ExpiresByType image/jpeg A ExpiresByType image/png A * 60 * 60 * 365 * 10 = seconds in ten years. You may wish to add other mime types such as application/x-shockwave-flash 24
25 Imgs Never Expire: mod_headers # Works with HTTP/1.1 only <FilesMatch "\.(gif jpe?g png)$"> Header set Cache-Control \ "max-age= " </FilesMatch> # Works with both HTTP/1.0 and HTTP/1.1 <FilesMatch "\.(gif jpe?g png)$"> Header set Expires \ "Mon, 28 Jul :30:00 GMT" </FilesMatch> 25 You may wish to add other file extensions such as swf Cache-Control is preferred for HTTP/1.1 Expires is for compatibility with HTTP/1.0 clients and proxies When both headers are present, HTTP/1.1 clients typically prefer the Cache- Control header 25
26 mod_images_never_expire /* Enforce policy with module that runs at URI translation hook */ static int translate_imgexpire(request_rec *r) { const char *ext; if ((ext = strrchr(r->uri, '.'))!= NULL) { if (strcasecmp(ext,".gif") == 0 strcasecmp(ext,".jpg") == 0 strcasecmp(ext,".png") == 0 strcasecmp(ext,".jpeg") == 0) { if (ap_table_get(r->headers_in,"if-modified-since")!= NULL ap_table_get(r->headers_in,"if-none-match")!= NULL) { /* Don't bother checking filesystem, just hand back a 304 */ return HTTP_NOT_MODIFIED; } } } return DECLINED; } 26 Also 26
27 3. Cookie-free static content Rate of change once published Frequently Occasionally Rarely/Never HTML CSS JavaScript Images Flash PDF Dynamic Content Static Content Personalized Same for everyone 27 27
28 Use a cookie-free Top Level Domain for static content For maximum efficiency use 2 domains for dynamic HTML static.example.net for images Many proxies won t cache Cookie requests But: multimedia is never personalized Cookies irrelevant for images 28 static.example.com won t cut it, because many cookies will be issued with domain=.example.com. Unless you re 100% sure you ll only issue cookies with domain= you ll need to use a completely different TLD. Yahoo!, for example, uses yahoo.com for dynamic HTML content and yimg.com for images and other static content. 28
29 Typical GET request w/cookies 29 GET /i/foo/bar/quux.gif HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-us; rv:1.7) Gecko/ Firefox/0.8 Accept: application/x-shockwaveflash,text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0. 8,video/x-mng,image/png,image/jpeg,image/gif;q=0.2,*/*;q=0.1 Cookie: U=mt=vtC1tp2MhYv9RL5BlpxYRFN_P8DpMJoamllEcA--&ux=IIr.AB&un=42vnticvufc8v; brandflash=1; B=amfco1503sgp8&b=2; F=a=NC184LcsvfX96G.JR27qSjCHu7bII3s. txa44psmlliftvojb_m5wecwy_.7&b=k1it; LYC=l_v=2&l_lv=7&l_l=h03m8d50c8bo &l_s=3yu2qxz5zvwquwwuzv22wrwr5t3w1zsr&l_lid=14rsb76&l_r=a8&l_um=1_0_1_0_0; GTSessionID = ; Y=v=1&n=6eecgejj7012f &l=h03m8d50c8bo/o&p=m012o &jb=16 47 &r=a8&lg=us&intl=us&np=1; PROMO=SOURCE=fp5; YGCV=d=; T=z=iTu.ABiZD/AB6dPWoqXibIcTzc0BjY3TzI3NTY0MzQ- &a=yae&sk=daawrz5hldun2t&d=c2wbt0rbekfurxdprfv3twpfek5ets0byqfzquubb2sbwlcwlqf0axabw UhaTVBBAXp6AWlUdS5BQmdXQQ--&af=QUFBQ0FDQURCOUFIQUJBQ0FEQUtBTE FNSDAmdHM9MTA5MDE4NDQxOCZwcz1lOG83MUVYcTYxOVouT2Ftc1ZFZUhBLS0-; LYS=l_fh=0&l_vo=myla; PA=p0=dg13DX4Ndgk-&p1=6L5qmg--&e=xMv.AB; YP.us=v=2&m=addr&d=1525+S+Robertson+Blvd%01Los+Angeles%01CA% %014480% % %019%01a% Referer: Accept-Language: en-us,en;q=0.7,he;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO ,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Since a Cookie header is sent, some proxies will refuse to cache the response. 29
30 Same request, no Cookies GET /i/foo/bar/quux.gif HTTP/1.1 Host: static.example.net User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-us; rv:1.7) Gecko/ Firefox/0.8 Accept: application/x-shockwaveflash,text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0. 8,video/x-mng,image/png,image/jpeg,image/gif;q=0.2,*/*;q=0.1 Referer: Accept-Language: en-us,en;q=0.7,he;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO ,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Bonus: much smaller GET request Dial-up MTU size 576 bytes, PPPoE bytes reduced to
31 4. Apache defaults for static, occasionally-changing content Rate of change once published Frequently Occasionally Rarely/Never HTML CSS JavaScript Images Flash PDF Dynamic Content Static Content Personalized Same for everyone 31 31
32 Revalidation works well Apache handles revalidation for static content Browser sends If-Modified-Since request Server replies with short 304 Not Modified No special configuration needed Use if you can t predict when content will change Page designers can change immediately No renaming necessary Cost: extra HTTP transaction for 304 Smaller with Keep-Alive, but large sites disable 32 Each HTTP request has some latency. When you disable Keep-Alive (as any large site typically must do to scale), each HTTP request requires a full 3-way TCP handshake. The handshake latency can be perceptible, especially on a slow connection such as a 56k modem. 32
33 Successful revalidation GET /foo/index.html HTTP/1.1 Host: If-Modified-Since: Thu, 12 May :08:50 GMT HTTP/ Not Modified Browser Cache 33 Apache simply stat()s the file and compares the timestamp to the If-Modified-Since timestamp. If the file s timestamp is less than or equal to the If-Modified-Since header, it returns 304 Not Modified. 33
34 Updated content GET /foo/index.html HTTP/1.1 Host: If-Modified-Since: Thu, 12 May :08:50 GMT HTTP/ OK Last-Modified: Wed, 13 Jul :57:22 GMT Content-Length: 4525 Content-Type: text/html Browser Cache 34 Content has been modified. Client tries to revalidate again, but revalidation fails because URI has been updated. Apache returns 200 OK with full content. 34
35 5. URL Tags for sensitive content, hit metering Rate of change once published Frequently Occasionally Rarely/Never HTML CSS JavaScript Images Flash PDF Dynamic Content Static Content Personalized Same for everyone 35 35
36 URL Tag technique Idea Convert public shared proxy caches into private caches Without breaking real private caches Implementation: pretty simple Assign a per-user URL tag No two users use same tag Users never see each other s content 36 36
37 URL Tag example Goal: accurate advertising statistics Do you trust proxies? Send Cache-Control: must-revalidate Count 304 Not Modified log entries as hits If you don t trust em Ask client to fetch tagged image URL Return 302 to highly cacheable image file Count 302s as hits Don t bother to look at cacheable server log 37 37
38 Hit-metering for ads (1) <script type="text/javascript"> var r = Math.random(); var t = new Date(); document.write("<img width='109' height='52' src=' + t.gettime() + ";r=" + r + "'>"); </script> <noscript> <img width="109" height="52" src= " </noscript> 38 No, this is not RFC 2227, which uses headers like Connection: meter and Meter: count=1/0 38
39 Hit-metering for ads (2) GET /ad/foo/bar.gif?t= ;r= HTTP/1.1 Host: ads.example.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-us; rv:1.7) Gecko/ Firefox/0.8 Referer: Cookie: uid=c50df33e-e b1f3-946aedf9308b HTTP/ Moved Temporarily Date: Wed, 28 Jul :45:06 GMT Location: Content-Type: text/html <a href="
40 Hit-metering for ads (3) GET /i/foo/bar.gif HTTP/1.1 Host: static.example.net User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-us; rv:1.7) Gecko/ Firefox/0.8 Referer: HTTP/ OK Date: Wed, 28 Jul :45:07 GMT Last-Modified: Mon, 05 Oct :32:51 GMT ETag: "69079e-ad cc8" Cache-Control: public,max-age= Expires: Mon, 28 Jul :45:07 GMT Content-Length: 6096 Content-Type: image/gif GIF89a
41 URL Tags & user experience Does not require modifying HTTP headers No need for Pragma: no-cache or Expires in past Doesn t break the Back button Browser history & visited-link highlighting JavaScript timestamps/random numbers Easy to implement Breaks visited link highlighting Session or Persistent ID preserves history A little harder to implement 41 41
42 Breaking the Back button User expectation: Back button works instantly Private caches normally enable this behavior Aggressive cache-busting breaks Back button Server sends Pragma: no-cache or Expires in past Browser must re-visit server to re-fetch page Hitting network much slower than hitting disk User perceives lag Use aggressive approach very sparingly Compromising user experience is A Bad Thing 42 42
43 Summary 43 43
44 Review: Top 5 techniques 1. Use Cache-Control: private for personalized content 2. Implement Images Never Expire policy 3. Use a cookie-free TLD for static content 4. Use Apache defaults for occasionallychanging static content 5. Use random tags in URL for accurate hit metering or very sensitive content 44 44
45 Pro-caching techniques Cache-Control: max-age=<bignum> Expires: <10 years into future> Generate static content headers Last-Modified, ETag Content-Length Avoid cgi-bin,.cgi or? in URLs Some proxies (e.g. Squid) won t cache Workaround: use PATH_INFO instead 45 In other words, these are ways to make dynamic content look like static content. 45
46 Cache-busting techniques Use POST instead of GET Use random strings and? char in URL Omit Content-Length & Last-Modified Send explicit headers on response Breaks the back button Only as a last resort Cache-Control: max-age=0,no-cache,no-store Expires: Tue, 11 Oct :34:56 GMT Pragma: no-cache 46 46
47 Recommended Reading Web Caching and Replication Michael Rabinovich & Oliver Spatscheck Addison-Wesley, 2001 Web Caching Duane Wessels O'Reilly,
48 Slides:
The Hyper-Text Transfer Protocol (HTTP)
The Hyper-Text Transfer Protocol (HTTP) Antonio Carzaniga Faculty of Informatics University of Lugano October 4, 2011 2005 2007 Antonio Carzaniga 1 HTTP message formats Outline HTTP methods Status codes
Security-Assessment.com White Paper Leveraging XSRF with Apache Web Server Compatibility with older browser feature and Java Applet
Security-Assessment.com White Paper Leveraging XSRF with Apache Web Server Compatibility with older browser feature and Java Applet Prepared by: Roberto Suggi Liverani Senior Security Consultant Security-Assessment.com
Protocolo HTTP. Web and HTTP. HTTP overview. HTTP overview
Web and HTTP Protocolo HTTP Web page consists of objects Object can be HTML file, JPEG image, Java applet, audio file, Web page consists of base HTML-file which includes several referenced objects Each
Project #2. CSE 123b Communications Software. HTTP Messages. HTTP Basics. HTTP Request. HTTP Request. Spring 2002. Four parts
CSE 123b Communications Software Spring 2002 Lecture 11: HTTP Stefan Savage Project #2 On the Web page in the next 2 hours Due in two weeks Project reliable transport protocol on top of routing protocol
HTTP. Internet Engineering. Fall 2015. Bahador Bakhshi CE & IT Department, Amirkabir University of Technology
HTTP Internet Engineering Fall 2015 Bahador Bakhshi CE & IT Department, Amirkabir University of Technology Questions Q1) How do web server and client browser talk to each other? Q1.1) What is the common
1. When will an IP process drop a datagram? 2. When will an IP process fragment a datagram? 3. When will a TCP process drop a segment?
Questions 1. When will an IP process drop a datagram? 2. When will an IP process fragment a datagram? 3. When will a TCP process drop a segment? 4. When will a TCP process resend a segment? CP476 Internet
Network Technologies
Network Technologies Glenn Strong Department of Computer Science School of Computer Science and Statistics Trinity College, Dublin January 28, 2014 What Happens When Browser Contacts Server I Top view:
Hypertext for Hyper Techs
Hypertext for Hyper Techs An Introduction to HTTP for SecPros Bio Josh Little, GSEC ~14 years in IT. Support, Server/Storage Admin, Webmaster, Web App Dev, Networking, VoIP, Projects, Security. Currently
Internet Technologies Internet Protocols and Services
QAFQAZ UNIVERSITY Computer Engineering Department Internet Technologies Internet Protocols and Services Dr. Abzetdin ADAMOV Chair of Computer Engineering Department aadamov@qu.edu.az http://ce.qu.edu.az/~aadamov
Demystifying cache. Kristian Lyngstøl Product Specialist Varnish Software AS
Demystifying cache Kristian Lyngstøl Product Specialist Varnish Software AS Montreal, March 2013 Agenda - The types of caches involved - The benefits of a cache - HTTP - Reverse proxy specifics Not: L1/L2
reference: HTTP: The Definitive Guide by David Gourley and Brian Totty (O Reilly, 2002)
1 cse879-03 2010-03-29 17:23 Kyung-Goo Doh Chapter 3. Web Application Technologies reference: HTTP: The Definitive Guide by David Gourley and Brian Totty (O Reilly, 2002) 1. The HTTP Protocol. HTTP = HyperText
CloudOYE CDN USER MANUAL
CloudOYE CDN USER MANUAL Password - Based Access Logon to http://mycloud.cloudoye.com. Enter your Username & Password In case, you have forgotten your password, click Forgot your password to request a
Playing with Web Application Firewalls
Playing with Web Application Firewalls Who is Wendel? Independent penetration test analyst. Affiliated to Hackaholic team. Over 7 years in the security industry. Discovered vulnerabilities in Webmails,
Research of Web Real-Time Communication Based on Web Socket
Int. J. Communications, Network and System Sciences, 2012, 5, 797-801 http://dx.doi.org/10.4236/ijcns.2012.512083 Published Online December 2012 (http://www.scirp.org/journal/ijcns) Research of Web Real-Time
The Web: some jargon. User agent for Web is called a browser: Web page: Most Web pages consist of: Server for Web is called Web server:
The Web: some jargon Web page: consists of objects addressed by a URL Most Web pages consist of: base HTML page, and several referenced objects. URL has two components: host name and path name: User agent
CS640: Introduction to Computer Networks. Applications FTP: The File Transfer Protocol
CS640: Introduction to Computer Networks Aditya Akella Lecture 4 - Application Protocols, Performance Applications FTP: The File Transfer Protocol user at host FTP FTP user client interface local file
No. Time Source Destination Protocol Info 1190 131.859385 128.238.245.34 128.119.245.12 HTTP GET /ethereal-labs/http-ethereal-file1.html HTTP/1.
Ethereal Lab: HTTP 1. The Basic HTTP GET/response interaction 1190 131.859385 128.238.245.34 128.119.245.12 HTTP GET /ethereal-labs/http-ethereal-file1.html HTTP/1.1 GET /ethereal-labs/http-ethereal-file1.html
GET /FB/index.html HTTP/1.1 Host: lmi32.cnam.fr
GET /FB/index.html HTTP/1.1 Host: lmi32.cnam.fr HTTP/1.1 200 OK Date: Thu, 20 Oct 2005 14:42:54 GMT Server: Apache/2.0.50 (Linux/SUSE) Last-Modified: Thu, 20 Oct 2005 14:41:56 GMT ETag: "2d7b4-14b-8efd9500"
THE PROXY SERVER 1 1 PURPOSE 3 2 USAGE EXAMPLES 4 3 STARTING THE PROXY SERVER 5 4 READING THE LOG 6
The Proxy Server THE PROXY SERVER 1 1 PURPOSE 3 2 USAGE EXAMPLES 4 3 STARTING THE PROXY SERVER 5 4 READING THE LOG 6 2 1 Purpose The proxy server acts as an intermediate server that relays requests between
sessionx Desarrollo de Aplicaciones en Red Web Applications History (1) Content History (2) History (3)
sessionx Desarrollo de Aplicaciones en Red José Rafael Rojano Cáceres http://www.uv.mx/rrojano Web Applications 1 2 Content History (1) History Http CGI Web Tiers ARPANet Email, Ftp, IRC, news Explosive
CDN Operation Manual
NTT Communications Cloudⁿ CDN Operation Manual Ver.1.1 Please refrain from secondary use such as distributing, reproducing, and transferring this document. 1 Version Number Edited on Revisions Ver.1.0
Varnish Tips & Tricks, 2015 edition
Varnish Tips & Tricks, 2015 edition ConFoo 2015 Montreal, Canada Magnus Hagander magnus@hagander.net PRODUCTS CONSULTING APPLICATION MANAGEMENT IT OPERATIONS SUPPORT TRAINING Magnus Hagander Redpill Linpro
Alteon Browser-Smart Load Balancing
T e c h n i c a l T i p TT-0411405a -- Information -- 24-Nov-2004 Contents: Introduction:...1 Associated Products:...1 Overview...1 Sample Configuration...3 Setup...3 Configuring PC1...4 Configuring PC2...4
Cache All The Things
Cache All The Things About Me Mike Bell Drupal Developer @mikebell_ http://drupal.org/user/189605 Exactly what things? erm... everything! No really... Frontend: - HTML - CSS - Images - Javascript Backend:
1945: 1989: ! Tim Berners-Lee (CERN) writes internal proposal to develop a. 1990:! Tim BL writes a graphical browser for Next machines.
Systemprogrammering 2009 Föreläsning 9 Web Services Topics! HTTP! Serving static content! Serving dynamic content 1945: 1989: Web History! Vannevar Bush, As we may think, Atlantic Monthly, July, 1945.
HTTP Protocol. Bartosz Walter <Bartek.Walter@man.poznan.pl>
HTTP Protocol Bartosz Walter Agenda Basics Methods Headers Response Codes Cookies Authentication Advanced Features of HTTP 1.1 Internationalization HTTP Basics defined in
By Bardia, Patit, and Rozheh
HTTP By Bardia, Patit, and Rozheh HTTP - Introduction - Hyper Text Transfer Protocol -uses the TCP/IP technology -has had the most impact on the World Wide Web (WWW) - specs in RFC 2616 (RFC2616) HTTP
Deployment Guide. Caching (Static & Dynamic) Deployment Guide. A Step-by-Step Technical Guide
Deployment Guide Caching (Static & Dynamic) Deployment Guide A Step-by-Step Technical Guide Deployment Guide Notice: The information in this publication is subject to change without notice. THIS PUBLICATION
The Web History (I) The Web History (II)
Goals of Today s Lecture EE 122: The World Wide Web Ion Stoica TAs: Junda Liu, DK Moon, David Zats http://inst.eecs.berkeley.edu/~ee122/ (Materials with thanks to Vern Paxson, Jennifer Rexford, and colleagues
HTTP Response Splitting
The Attack HTTP Response Splitting is a protocol manipulation attack, similar to Parameter Tampering The attack is valid only for applications that use HTTP to exchange data Works just as well with HTTPS
Architecture of So-ware Systems HTTP Protocol. Mar8n Rehák
Architecture of So-ware Systems HTTP Protocol Mar8n Rehák HTTP Protocol Hypertext Transfer Protocol Designed to transfer hypertext informa8on over the computer networks Hypertext: Structured text with
World Wide Web. Before WWW
World Wide Web Joao.Neves@fe.up.pt Before WWW Major search tools: Gopher and Archie Archie Search FTP archives indexes Filename based queries Gopher Friendly interface Menu driven queries João Neves 2
SiteCelerate white paper
SiteCelerate white paper Arahe Solutions SITECELERATE OVERVIEW As enterprises increases their investment in Web applications, Portal and websites and as usage of these applications increase, performance
Cyber Security Workshop Ethical Web Hacking
Cyber Security Workshop Ethical Web Hacking May 2015 Setting up WebGoat and Burp Suite Hacking Challenges in WebGoat Concepts in Web Technologies and Ethical Hacking 1 P a g e Downloading WebGoat and Burp
Acunetix Website Audit. 5 November, 2014. Developer Report. Generated by Acunetix WVS Reporter (v8.0 Build 20120808)
Acunetix Website Audit 5 November, 2014 Developer Report Generated by Acunetix WVS Reporter (v8.0 Build 20120808) Scan of http://filesbi.go.id:80/ Scan details Scan information Starttime 05/11/2014 14:44:06
Computer Networks. Lecture 7: Application layer: FTP and HTTP. Marcin Bieńkowski. Institute of Computer Science University of Wrocław
Computer Networks Lecture 7: Application layer: FTP and Marcin Bieńkowski Institute of Computer Science University of Wrocław Computer networks (II UWr) Lecture 7 1 / 23 Reminder: Internet reference model
CTIS 256 Web Technologies II. Week # 1 Serkan GENÇ
CTIS 256 Web Technologies II Week # 1 Serkan GENÇ Introduction Aim: to be able to develop web-based applications using PHP (programming language) and mysql(dbms). Internet is a huge network structure connecting
ivoyeur: permission to parse
D A V I D J O S E P H S E N ivoyeur: permission to parse David Josephsen is the author of Building a Monitoring Infrastructure with Nagios (Prentice Hall PTR, 2007) and Senior Systems Engineer at DBG,
Implementing Reverse Proxy Using Squid. Prepared By Visolve Squid Team
Implementing Reverse Proxy Using Squid Prepared By Visolve Squid Team Introduction What is Reverse Proxy Cache About Squid How Reverse Proxy Cache work Configuring Squid as Reverse Proxy Configuring Squid
Outline Definition of Webserver HTTP Static is no fun Software SSL. Webserver. in a nutshell. Sebastian Hollizeck. June, the 4 th 2013
Definition of in a nutshell June, the 4 th 2013 Definition of Definition of Just another definition So what is it now? Example CGI php comparison log-file Definition of a formal definition Aisaprogramthat,usingthe
Arnaud Becart ip- label 11/9/11
Arnaud Becart ip- label 11/9/11 RUM Synthe2c Tests You should measure HTML and RIA (Flash ) Page Rendering Onload + Full Page Load InteracBons in your page Third Party content How Synthe2c / Real browsers
N-tier ColdFusion scalability. N-tier ColdFusion scalability WebManiacs 2008 Jochem van Dieten
N-tier ColdFusion scalability About me ColdFusion developer for over 10 year Adobe Community Expert for ColdFusion CTO for Prisma IT in the Netherlands consultancy development hosting training Find me
CONTENT of this CHAPTER
CONTENT of this CHAPTER v DNS v HTTP and WWW v EMAIL v SNMP 3.2.1 WWW and HTTP: Basic Concepts With a browser you can request for remote resource (e.g. an HTML file) Web server replies to queries (e.g.
Chapter 27 Hypertext Transfer Protocol
Chapter 27 Hypertext Transfer Protocol Columbus, OH 43210 Jain@CIS.Ohio-State.Edu http://www.cis.ohio-state.edu/~jain/ 27-1 Overview Hypertext language and protocol HTTP messages Browser architecture CGI
Speed up your web site. Alan Seiden Consulting alanseiden.com
alanseiden.com Alan s PHP on IBM i focus Consultant to innovative IBM i and PHP users PHP project leader, Zend/IBM Toolkit Contributor, Zend Framework DB2 enhancements Award-winning developer Authority,
DEPLOYMENT GUIDE Version 1.1. Deploying the BIG-IP LTM v10 with Citrix Presentation Server 4.5
DEPLOYMENT GUIDE Version 1.1 Deploying the BIG-IP LTM v10 with Citrix Presentation Server 4.5 Table of Contents Table of Contents Deploying the BIG-IP system v10 with Citrix Presentation Server Prerequisites
Web Security: SSL/TLS
CSE 484 / CSE M 584: Computer Security and Privacy Web Security: SSL/TLS Spring 2015 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno,
Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh
Web applications Web security: web basics Myrto Arapinis School of Informatics University of Edinburgh HTTP March 19, 2015 Client Server Database (HTML, JavaScript) (PHP) (SQL) 1 / 24 2 / 24 URLs HTTP
Web. Services. Web Technologies. Today. Web. Technologies. Internet WWW. Protocols TCP/IP HTTP. Apache. Next Time. Lecture #3 2008 3 Apache.
JSP, and JSP, and JSP, and 1 2 Lecture #3 2008 3 JSP, and JSP, and Markup & presentation (HTML, XHTML, CSS etc) Data storage & access (JDBC, XML etc) Network & application protocols (, etc) Programming
Table of Contents. Open-Xchange Authentication & Session Handling. 1.Introduction...3
Open-Xchange Authentication & Session Handling Table of Contents 1.Introduction...3 2.System overview/implementation...4 2.1.Overview... 4 2.1.1.Access to IMAP back end services...4 2.1.2.Basic Implementation
Crowbar: New generation web application brute force attack tool
Crowbar: New generation web application brute force attack tool 1 Tables of contents Introduction... 3 Challenges with brute force attacks... 3 Crowbar a fresh approach... 3 Other applications of crowbar...
Anatomy of a Pass-Back-Attack: Intercepting Authentication Credentials Stored in Multifunction Printers
Anatomy of a Pass-Back-Attack: Intercepting Authentication Credentials Stored in Multifunction Printers By Deral (PercX) Heiland and Michael (omi) Belton Over the past year, one focus of the Foofus.NET
Front-End Performance Testing and Optimization
Front-End Performance Testing and Optimization Abstract Today, web user turnaround starts from more than 3 seconds of response time. This demands performance optimization on all application levels. Client
Information Extraction Art of Testing Network Peripheral Devices
OWASP AppSec Brazil 2010, Campinas, SP The OWASP Foundation http://www.owasp.org Information Extraction Art of Testing Network Peripheral Devices Aditya K Sood, SecNiche Security (adi_ks@secniche.org)
TCP/IP Networking An Example
TCP/IP Networking An Example Introductory material. This module illustrates the interactions of the protocols of the TCP/IP protocol suite with the help of an example. The example intents to motivate the
Sticky Session Setup and Troubleshooting
1 Sticky Session Setup and Troubleshooting Day, Date, 2004 time p.m. ET Teleconference Access: US & Canada: 888-259-4812 Teleconference Access: North America: xxxx Toll Number: 706-679-4880 International:
Internet Technologies. World Wide Web (WWW) Proxy Server Network Address Translator (NAT)
Internet Technologies World Wide Web (WWW) Proxy Server Network Address Translator (NAT) What is WWW? System of interlinked Hypertext documents Text, Images, Videos, and other multimedia documents navigate
Application layer Web 2.0
Information Network I Application layer Web 2.0 Youki Kadobayashi NAIST They re revolving around the web, after all Name any Internet-related buzz: Cloud computing Smartphone Social media... You ll end
Barracuda Networks Web Application Firewall
McAfee Enterprise Security Manager Data Source Configuration Guide Data Source: Barracuda Networks Web Application Firewall January 30, 2015 Barracuda Networks Web Application Firewall Page 1 of 10 Important
Internet Technologies 4-http. F. Ricci 2010/2011
Internet Technologies 4-http F. Ricci 2010/2011 Content Hypertext Transfer Protocol Structure of a message Methods Headers Parameters and character encoding Proxy Caching HTTP 1.1: chunked transfer and
All You Can Eat Realtime
HTML5 WebSocket: All You Can Eat Realtime By Peter Lubbers, Kaazing May 14, 2010 1 About Peter Lubbers Director of Documentation and Training, Kaazing Co-Founder San Francisco HTML5 User Group http://www.sfhtml5.org/
Chapter 5 Configuring the Remote Access Web Portal
Chapter 5 Configuring the Remote Access Web Portal This chapter explains how to create multiple Web portals for different users and how to customize the appearance of a portal. It describes: Portal Layouts
Vodia PBX RESTful API (v2.0)
Vodia PBX RESTful API (v2.0) 2015 Vodia Networks Inc. All rights reserved. Page 1 of 30 Contents Login... 3 Get license info... 4 Get a complete list of domains... 5 Get the details of a specific domain...
Web Services April 21st, 2009 with Hunter Pitelka
15 213 The course that gives CMU its Zip! Web Services April 21st, 2009 with Hunter Pitelka Topics HTTP Serving static content Serving dynamic content Web History 1989: 1990: Tim Berners Lee (CERN) writes
International Journal of Engineering & Technology IJET-IJENS Vol:14 No:06 44
International Journal of Engineering & Technology IJET-IJENS Vol:14 No:06 44 Data Traffic and Security over Internet via Monitoring and Analyzing the HTTP Protocol Ezmolda Barolli, Loren Nebiaj, Gloria
Developing Applications With The Web Server Gateway Interface. James Gardner EuroPython 3 rd July 2006 www.3aims.com
Developing Applications With The Web Server Gateway Interface James Gardner EuroPython 3 rd July 2006 www.3aims.com Aims Show you how to write WSGI applications Quick recap of HTTP, then into the nitty
600-152 People Data and the Web Forms and CGI CGI. Facilitating interactive web applications
CGI Facilitating interactive web applications Outline In Informatics 1, worksheet 7 says You will learn more about CGI and forms if you enroll in Informatics 2. Now we make good on that promise. First
Playing with Web Application Firewalls
Playing with Web Application Firewalls DEFCON 16, August 8-10, 2008, Las Vegas, NV, USA Who is Wendel Guglielmetti Henrique? Penetration Test analyst at SecurityLabs - Intruders Tiger Team Security division
Chapter 6 Virtual Private Networking Using SSL Connections
Chapter 6 Virtual Private Networking Using SSL Connections The FVS336G ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN provides a hardwarebased SSL VPN solution designed specifically to provide
ATS Test Documentation
ATS Test Documentation Release 0.1 Feifei Cai March 31, 2015 Contents 1 HTTP 3 1.1 Keep-alive................................................ 3 1.2 Connection Timeouts...........................................
Web Application Security
Web Application Security The OWASP Foundation Securing the application Input validation Authorization Session mgmt Config mgmt Authenticatio n Error handling Web server App server DB server Secure storage
WHAT IS A WEB SERVER?
4663ch01.qxd_lb 12/2/99 12:54 PM Page 1 CHAPTER 1 WHAT IS A WEB SERVER? Never trust a computer you can t throw out a window. Steve Wozniak CHAPTER OBJECTIVES In this chapter you will learn about: Client/Server
79 Tips and Tricks for Magento Performance Improvement. for Magento Performance Improvement
79 Tips and Tricks for Magento Performance Improvement A Checklist to Faster Load Times and Higher Conversion Rates Your website visitors crave fast load times and speedy product search. In fact, almost
1 Introduction: Network Applications
1 Introduction: Network Applications Some Network Apps E-mail Web Instant messaging Remote login P2P file sharing Multi-user network games Streaming stored video clips Internet telephone Real-time video
P and FTP Proxy caching Using a Cisco Cache Engine 550 an
P and FTP Proxy caching Using a Cisco Cache Engine 550 an Table of Contents HTTP and FTP Proxy caching Using a Cisco Cache Engine 550 and a PIX Firewall...1 Introduction...1 Before You Begin...1 Conventions...1
URLs and HTTP. ICW Lecture 10 Tom Chothia
URLs and HTTP ICW Lecture 10 Tom Chothia This Lecture The two basic building blocks of the web: URLs: Uniform Resource Locators HTTP: HyperText Transfer Protocol Uniform Resource Locators Many Internet
Lecture 8a: WWW Proxy Servers and Cookies
Internet and Intranet Protocols and Applications Lecture 8a: WWW Proxy Servers and Cookies March, 2004 Arthur Goldberg Computer Science Department New York University artg@cs.nyu.edu Terminology Origin
DEPLOYMENT GUIDE DEPLOYING THE BIG-IP LTM SYSTEM WITH CITRIX PRESENTATION SERVER 3.0 AND 4.5
DEPLOYMENT GUIDE DEPLOYING THE BIG-IP LTM SYSTEM WITH CITRIX PRESENTATION SERVER 3.0 AND 4.5 Deploying F5 BIG-IP Local Traffic Manager with Citrix Presentation Server Welcome to the F5 BIG-IP Deployment
Networks and the Internet A Primer for Prosecutors and Investigators
Computer Crime & Intellectual Property Section Networks and the Internet A Primer for Prosecutors and Investigators Michael J. Stawasz Senior Counsel Computer Crime and Intellectual Property Section ()
Lecture 8a: WWW Proxy Servers and Cookies
Internet and Intranet Protocols and Applications Lecture 8a: WWW Proxy Servers and Cookies March 12, 2003 Arthur Goldberg Computer Science Department New York University artg@cs.nyu.edu Terminology Origin
CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 20
CIS 551 / TCOM 401 Computer and Network Security Spring 2007 Lecture 20 Announcements Reminder: Project 3 is available on the web pages Due: April 3rd Midterm II has been graded Today: Web Security [Some
Application Layer: HTTP and the Web. Srinidhi Varadarajan
Application Layer: HTTP and the Web Srinidhi Varadarajan The Web: the http protocol http: hypertext transfer protocol Web s application layer protocol client/server model client: browser that requests,
HTTP Authentifizierung
HTTP Authentifizierung Valentin Lein Matr. Nr. 0526536 15.12.2010 Computer Technology /21 Inhalt HTTP Basic Authentication Alternative Authentifizierungsmöglichkeiten HTTP Hypertext Transfer Protocol Computer
T14 SECURITY TESTING: ARE YOU A DEER IN THE HEADLIGHTS? Ryan English SPI Dynamics Inc BIO PRESENTATION. Thursday, May 18, 2006 1:30PM
BIO PRESENTATION T14 Thursday, May 18, 2006 1:30PM SECURITY TESTING: ARE YOU A DEER IN THE HEADLIGHTS? Ryan English SPI Dynamics Inc International Conference On Software Testing Analysis and Review May
PHP code audits. OSCON 2009 San José, CA, USA July 21th 2009
PHP code audits OSCON 2009 San José, CA, USA July 21th 2009 1 Agenda Workshop presentation Black box audit Source code audit 2 Who speaks? Philippe Gamache Parler Haut, Interagir Librement : Web development,
CS 188/219. Scalable Internet Services Andrew Mutz October 8, 2015
CS 188/219 Scalable Internet Services Andrew Mutz October 8, 2015 For Today About PTEs Empty spots were given out If more spots open up, I will issue more PTEs You must have a group by today. More detail
Module 45 (More Web Hacking)
(More Web Hacking) In this Module, you'll lear how to use netcat to perform cursory server reconnaissance. You'll lear what a web proxy is and how it functions. You'll know how to enable your browser to
CS 213, Fall 2000 Lab Assignment L5: Logging Web Proxy Assigned: Nov. 28, Due: Mon. Dec. 11, 11:59PM
CS 213, Fall 2000 Lab Assignment L5: Logging Web Proxy Assigned: Nov. 28, Due: Mon. Dec. 11, 11:59PM Jason Crawford (jasonc@cs.cmu.edu) is the lead person for this assignment. Introduction A web proxy
HOST EUROPE CLOUD STORAGE REST API DEVELOPER REFERENCE
HOST EUROPE CLOUD STORAGE REST API DEVELOPER REFERENCE REST API REFERENCE REST OVERVIEW Host Europe REST Storage Service uses HTTP protocol as defned by RFC 2616. REST operations consist in sending HTTP
Data Communication I
Data Communication I Urban Bilstrup (E327) 090901 Urban.Bilstrup@ide.hh.se www2.hh.se/staff/urban Internet - Sweden, Northern Europe SUNET NORDUnet 2 Internet - Internet Addresses Everyone should be able
Performance Report for: http://singaporestockstrading.com/ Report generated: Friday, April 24, 2015, 7:29 AM -0700 (via API)
The web should be fast. Executive Summary Performance Report for: http://singaporestockstrading.com/ Report generated: Friday, April, 5, : AM - (via API) Test Region: Vancouver, Canada Using: Firefox (Desktop)
APACHE WEB SERVER. Andri Mirzal, PhD N28-439-03
APACHE WEB SERVER Andri Mirzal, PhD N28-439-03 Introduction The Apache is an open source web server software program notable for playing a key role in the initial growth of the World Wide Web Typically
Deployment Guide. AX Series with Microsoft Office SharePoint Server
Deployment Guide AX Series with Microsoft Office SharePoint Server Table of Contents DEPLOYMENT GUIDE AX Series with Microsoft Office SharePoint Server Introduction... 1 Prerequisites & Assumptions...
Securing The Apache Web Server. Agenda. Background. Matthew Cook http://escarpment.net/
Securing The Apache Web Server Matthew Cook http://escarpment.net/ Agenda Background Web Servers Connections Apache History System Attacks Securing Apache Useful Tools In Summary Further Advice and Guidance
Chapter 2: Interactive Web Applications
Chapter 2: Interactive Web Applications 2.1 Interactivity and Multimedia in the WWW architecture 2.2 Interactive Client-Side Scripting for Multimedia (Example HTML5/JavaScript) 2.3 Interactive Server-Side
An Insight into Cookie Security
An Insight into Cookie Security Today most websites and web based applications use cookies. Cookies are primarily used by the web server to track an authenticated user or other user specific details. This
making drupal run fast
making drupal run fast 2 Objectives Improve drupal performance Provide Simple tips on Increasing Drupal performance We have some data from load testing a site in these different configs: ++ plain drupal
How to Run an Apache HTTP Server With a Protocol
HTTP Servers Jacco van Ossenbruggen CWI/VU Amsterdam 1 Learning goals Understand: Basis HTTP server functionality Serving static content from HTML and other files Serving dynamic content from software
DEERFIELD.COM. DNS2Go Update API. DNS2Go Update API
DEERFIELD.COM DNS2Go Update API DNS2Go Update API DEERFIELD.COM PRODUCT DOCUMENTATION DNS2Go Update API Deerfield.com 4241 Old U.S. 27 South Gaylord, MI 49686 Phone 989.732.8856 Email sales@deerfield.com
COMP 112 Assignment 1: HTTP Servers
COMP 112 Assignment 1: HTTP Servers Lead TA: Jim Mao Based on an assignment from Alva Couch Tufts University Due 11:59 PM September 24, 2015 Introduction In this assignment, you will write a web server