Skip to content

fix: do not answer If-Modified-Since with 304 without Last-Modified - #146

Open
lprnmns wants to merge 1 commit into
fastify:mainfrom
lprnmns:fix/ims-without-last-modified
Open

lprnmns wants to merge 1 commit into
fastify:mainfrom
lprnmns:fix/ims-without-last-modified

Conversation

@lprnmns

@lprnmns lprnmns commented Oct 23, 2026 •

Copy link
Copy Markdown

With lastModified: false, any request carrying If-Modified-Since is answered with 304 Not Modified, however old the date is:

$ curl -i -H 'If-Modified-Since: Thu, 01 Jan 1970 00:00:00 GMT' http://127.0.0.1:18765/   # send(req, '/name.txt', { root, lastModified: false })
HTTP/1.1 304 Not Modified

isNotModifiedFailure() treats a missing Last-Modified as "not modified":

if (!lastModified || (Date.parse(lastModified) <= Date.parse(ifModifiedSince))) {
  return true
}

With nothing to compare against, the response should be considered stale. That's what fresh does (var modifiedStale = !lastModified || !(…)), and it is what this module did before #31 replaced the fresh() call with an inlined check. In practice the 304 traps clients that still hold a Last-Modified from before lastModified was turned off (for example after switching to content hashes, or for files whose mtime is meaningless). They keep revalidating with If-Modified-Since and never receive the new content. @fastify/static passes lastModified through, so it has the same behavior.

The condition now only returns true when there is a Last-Modified to compare. An unparsable If-Modified-Since still yields a fresh 200, as before.

Test: "should respond with 200 when Last-Modified is disabled" in the If-Modified-Since block of test/send.2.test.js fails without the change. npm test passes (214 tests, 100% coverage, tstyche) and npm run lint is clean.

@gurgunday gurgunday left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants