No cache-control header on local_secure images #3516

New Issue

OVERLORD · 2026-02-05T06:57:00+03:00

OVERLORD commented

2026-02-05 06:57:00 +03:00

Originally created by @vlaborie on GitHub (Feb 17, 2023).

Describe the Bug

No cache-control header are defined on images when using local_secure storage which implies re-downloading image every time a page is loaded and bad loading time performance.

Apparently, this come from PreventAuthenticatedResponseCaching.php which complety disable cache-control header.

Steps to Reproduce

Enable local_secure storage for images
Go on any page with images
Images are downloaded every time a page is loaded and not cached

Expected Behaviour

Bookstack set a cache-control header with long time on image loaded from local_secure storage.

Screenshots or Additional Context

No response

Browser Details

No response

Exact BookStack Version

v21.11.1

PHP Version

No response

Hosting Environment

Docker + Kubernetes + Ingress Nginx proxy

Originally created by @vlaborie on GitHub (Feb 17, 2023). ### Describe the Bug No **cache-control** header are defined on images when using **local_secure** storage which implies re-downloading image every time a page is loaded and bad loading time performance. Apparently, this come from [PreventAuthenticatedResponseCaching.php](https://github.com/BookStackApp/BookStack/blob/development/app/Http/Middleware/PreventAuthenticatedResponseCaching.php) which complety disable cache-control header. ### Steps to Reproduce 1. Enable **local_secure** storage for images 2. Go on any page with images 3. Images are downloaded every time a page is loaded and not cached ### Expected Behaviour Bookstack set a cache-control header with long time on image loaded from local_secure storage. ### Screenshots or Additional Context _No response_ ### Browser Details _No response_ ### Exact BookStack Version v21.11.1 ### PHP Version _No response_ ### Hosting Environment Docker + Kubernetes + Ingress Nginx proxy

OVERLORD added the 🐛 Bug label 2026-02-05 06:57:00 +03:00

OVERLORD closed this issue

2026-02-05 06:57:05 +03:00

OVERLORD commented

2026-02-05 06:57:07 +03:00

@ssddanbrown commented on GitHub (Feb 18, 2023):

Hi @vlaborie,
This isn't really a bug or break in existing logic, it's more a desire or omission compared to your expectations.

While we could add longer-cache control headers to served images, it becomes a little more complex when security/access-control is factored in, so we take a safe default of not overring the prevented caching here.
If you really desire caching to be in place for these images, you could likely force cache headers for image resources at a webserver/proxy level.

@ssddanbrown commented on GitHub (Feb 18, 2023): Hi @vlaborie, This isn't really a bug or break in existing logic, it's more a desire or omission compared to your expectations. While we could add longer-cache control headers to served images, it becomes a little more complex when security/access-control is factored in, so we take a safe default of not overring the prevented caching here. If you really desire caching to be in place for these images, you could likely force cache headers for image resources at a webserver/proxy level.

OVERLORD commented

2026-02-05 06:57:10 +03:00

@vlaborie commented on GitHub (Feb 20, 2023):

Hi @ssddanbrown and thank's for your response.

Sorry if i mislabelled this issue, fell free to relabel it if you don't consider it as a bug.

I understand the security concern of HTTP cache but this only apply to dynamic content, like html, not on images.

I use https://github.com/solidnerd/docker-bookstack container for running Bookstack on Kubernetes and can't easily patch cache header without too much maintenance overhead for me.

I need this to be patched on the Docker container or in Bookstack directly (and i prefer this to be patched on the source).

Do you think cache-control header on images can be added on Bookstack or this is to complex because of access-control ?

I just saw you offer Bookstack support, i might be able to finance dev time for this issue if you think is doable.

@vlaborie commented on GitHub (Feb 20, 2023): Hi @ssddanbrown and thank's for your response. Sorry if i mislabelled this issue, fell free to relabel it if you don't consider it as a bug. I understand the security concern of HTTP cache but this only apply to dynamic content, like html, not on images. I use https://github.com/solidnerd/docker-bookstack container for running Bookstack on Kubernetes and can't easily patch cache header without too much maintenance overhead for me. I need this to be patched on the Docker container or in Bookstack directly (and i prefer this to be patched on the source). Do you think cache-control header on images can be added on Bookstack or this is to complex because of access-control ? I just saw you offer Bookstack support, i might be able to finance dev time for this issue if you think is doable.

OVERLORD commented

2026-02-05 06:57:14 +03:00

@ssddanbrown commented on GitHub (Mar 6, 2023):

I understand the security concern of HTTP cache but this only apply to dynamic content, like html, not on images.

Not really, It can apply to any served content including images.

... on Kubernetes and can't easily patch cache header without too much maintenance overhead for me.
I need this to be patched on the Docker container or in Bookstack directly (and i prefer this to be patched on the source)

I understand that but I'd prefer to not add complexity to the core project for what can be controlled via other means, and the complexity/inflexibility of your environment is not a viable reason for me to move that complexity to the project.

I'll therefore close this off.

@ssddanbrown commented on GitHub (Mar 6, 2023): > I understand the security concern of HTTP cache but this only apply to dynamic content, like html, not on images. Not really, It can apply to any served content including images. > ... on Kubernetes and can't easily patch cache header without too much maintenance overhead for me. > I need this to be patched on the Docker container or in Bookstack directly (and i prefer this to be patched on the source) I understand that but I'd prefer to not add complexity to the core project for what can be controlled via other means, and the complexity/inflexibility of your environment is not a viable reason for me to move that complexity to the project. I'll therefore close this off.

OVERLORD referenced this issue

2026-02-05 10:26:55 +03:00

[PR #3516] [CLOSED] Bump guzzlehttp/guzzle from 7.4.4 to 7.4.5 #6210

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#3516