Repository navigation
Replies: 1 comment
|
I found the original discussion (fortunately my employer has a Red Hat subscription) in https://issues.redhat.com/browse/KEYCLOAK-5141 and it looks like this was intended to prevent caching for different CORS origins:
That sounds like a problem which would be better solved by using |
Uh oh!
There was an error while loading. Please reload this page.
#4290 made the stated change but it also changed the HTTP caching behaviour to prevent caching for URLs like
/auth/realms/…/.well-known/openid-configurationor/auth/realms/…/protocol/openid-connect/certs. I first noticed this while looking at performance issues for a Keycloak server and was thinking that it might make sense to reconsider preventing those from being cached. On our server, roughly 80% of the bytes served and 35% of the total number of requests are for those endpoints.It's true that those values change but it would still be possible for Keycloak to set a short cache period. That would have two benefits: the first would be a performance improvement for deployments like ours where a CDN could cache those responses for a period of time and substantially reduce the number of requests which need to go back to the origin server, but the second would be that the performance and reliability issues are motivating client developers to implement their own caching logic. That can provide a sizable benefit but also means that the Keycloak administrator has no visibility into it and has to hope that the client developers pick appropriate timeouts and error resolution strategies. If Keycloak set
Cache-Controland/or RFC 9213CDN-Cache-Controlheader it would allow the service and its administrator to control the schedule for timeouts, and the latter would allow the server administrator to allow an intermediary which they control (Cloudflare, Fastly, Akamai, etc.) to cache these values for longer than a third-party client should.I didn't find a previous issue for
.well-known/openid-configurationbut #15216 also identified performance issues withprotocol/openid-connect/certsbeing uncacheable.All reactions