Validation doesn't work

[subnix]

According to clause No. 4.3 of RFC 7234:

4.3. Validation
When a cache has one or more stored responses for a requested URI, but cannot serve any of them (e.g., because they are not fresh, or one cannot be selected; see Section 4.1), it can use the conditional request mechanism
...
This process is known as "validating" or "revalidating" the stored response.
4.3.1. Sending a Validation Request
When sending a conditional request for cache validation, a cache sends one or more precondition header fields containing validator metadata from its stored response(s), which is then compared by recipients to determine whether a stored response is equivalent to a current representation of the resource.
One such validator is the timestamp given in a Last-Modified header field...
Another validator is the entity-tag given in an ETag header field...

Thus, I expect caddy to cache the first response and subsequently validate cached data via a conditional request. However, caddy simply forwards a request to an upstream without any conditions.

I've tested it only with Last-Modified and no-cache, because of the bug I noticed with ETag. Additionally, I couldn't trigger revalidation using other directives like must-revalidate and stale-while-revalidate.

Reproduction steps:

{
    log
    cache {
        stale 60s
    }
}

http://localhost:80 {
    log
    cache
    reverse_proxy http://localhost:81
}

http://localhost:81 {
    log
    header Last-Modified "Mon, 15 Dec 2025 08:52:20 GMT"
    header Cache-Control "no-cache"
    respond "Hello world"
}

$ curl -ik localhost:80
HTTP/1.1 200 OK
Cache-Control: no-cache
Cache-Status: Souin; fwd=uri-miss; stored; key=GET-http-localhost-/
Last-Modified: Mon, 15 Dec 2025 08:52:20 GMT
...
$ curl -ik localhost:80
HTTP/1.1 200 OK
Cache-Control: no-cache
Cache-Status: Souin; fwd=request; fwd-status=200; key=GET-http-localhost-/; detail=REQUEST-REVALIDATION
Last-Modified: Mon, 15 Dec 2025 08:52:20 GMT
...

logs:

{"level":"info","ts":1766736377.4338582,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"127.0.0.1","remote_port":"48850","client_ip":"127.0.0.1","proto":"HTTP/1.1","method":"GET","host":"localhost","uri":"/","headers":{"X-Forwarded-Proto":["http"],"Accept-Encoding":["gzip"],"Accept":["*/*"],"Date":["Fri, 26 Dec 2025 08:06:17 UTC"],"Via":["1.1 Caddy"],"X-Forwarded-Host":["localhost"],"User-Agent":["curl/8.7.1"],"X-Forwarded-For":["172.16.249.1"]}},"bytes_read":0,"user_id":"","duration":0.000199667,"size":11,"status":200,"resp_headers":{"Content-Type":["text/plain; charset=utf-8"],"Server":["Caddy"],"Last-Modified":["Mon, 15 Dec 2025 08:52:20 GMT"],"Cache-Control":["no-cache"]}}
{"level":"info","ts":1766736377.4560177,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"172.16.249.1","remote_port":"57879","client_ip":"172.16.249.1","proto":"HTTP/1.1","method":"GET","host":"localhost","uri":"/","headers":{"User-Agent":["curl/8.7.1"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.023146958,"size":11,"status":200,"resp_headers":{"Last-Modified":["Mon, 15 Dec 2025 08:52:20 GMT"],"Server":["Caddy"],"Content-Length":["11"],"Via":["1.1 Caddy"],"Date":["Fri, 26 Dec 2025 08:06:17 GMT"],"Cache-Control":["no-cache"],"Content-Type":["text/plain; charset=utf-8"],"Cache-Status":["Souin; fwd=uri-miss; stored; key=GET-http-localhost-/"]}}
{"level":"info","ts":1766736406.6892934,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"127.0.0.1","remote_port":"48850","client_ip":"127.0.0.1","proto":"HTTP/1.1","method":"GET","host":"localhost","uri":"/","headers":{"X-Forwarded-For":["172.16.249.1"],"X-Forwarded-Host":["localhost"],"X-Forwarded-Proto":["http"],"Accept":["*/*"],"Date":["Fri, 26 Dec 2025 08:06:46 UTC"],"Via":["1.1 Caddy"],"Accept-Encoding":["gzip"],"User-Agent":["curl/8.7.1"]}},"bytes_read":0,"user_id":"","duration":0.000023417,"size":11,"status":200,"resp_headers":{"Server":["Caddy"],"Last-Modified":["Mon, 15 Dec 2025 08:52:20 GMT"],"Cache-Control":["no-cache"],"Content-Type":["text/plain; charset=utf-8"]}}
{"level":"info","ts":1766736406.6932402,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"172.16.249.1","remote_port":"57892","client_ip":"172.16.249.1","proto":"HTTP/1.1","method":"GET","host":"localhost","uri":"/","headers":{"Accept":["*/*"],"User-Agent":["curl/8.7.1"]}},"bytes_read":0,"user_id":"","duration":0.019553791,"size":11,"status":200,"resp_headers":{"Content-Length":["11"],"Last-Modified":["Mon, 15 Dec 2025 08:52:20 GMT"],"Via":["1.1 Caddy"],"Cache-Control":["no-cache"],"Content-Type":["text/plain; charset=utf-8"],"Cache-Status":["Souin; fwd=request; fwd-status=200; key=GET-http-localhost-/; detail=REQUEST-REVALIDATION"],"Server":["Caddy"],"Date":["Fri, 26 Dec 2025 08:06:46 GMT"]}}

As we may see, the request made by caddy is not conditional.

[darkweak]

Hello @subnix because of the Cache-Control "no-cache" response header in your snippet, the response has to be revalidated. (Note that I'm testing with the latest release of the storages and at least the commit 2e1f6692f8473b66b0ef51e132d7b95e9a0c0684 so you can test it using the Souin repository directly)

xcaddy build \
    --with github.com/darkweak/souin/plugins/caddy@2e1f6692f8473b66b0ef51e132d7b95e9a0c0684 \
    --with github.com/darkweak/souin@2e1f6692f8473b66b0ef51e132d7b95e9a0c0684

[subnix]

@darkweak Yes, the response should definitely be revalidated. However, it simply forwards the request without a conditional header like If-Modified-Since. Even though it returns detail=REQUEST-REVALIDATION, without a conditional header, it's not a revalidation.

[darkweak]

Do you mean the cache server must proxy the request and add an additional header If-Modified-Since with the value of the date response header?

[subnix]

Yes, as described in the RFC. By the way, the new RFC 9111 defines this more precisely:

When generating a conditional request for validation, a cache:
MUST send the relevant entity tags (using If-Match, If-None-Match, or If-Range) if the entity tags were provided in the stored response(s) being validated.
SHOULD send the Last-Modified value (using If-Modified-Since) if the request is not for a subrange, a single stored response is being validated, and that response contains a Last-Modified value.
MAY send the Last-Modified value (using If-Unmodified-Since or If-Range) if the request is for a subrange, a single stored response is being validated, and that response contains only a Last-Modified value (not an entity tag).