Bug 41929

Summary: Add Cache-Control to opac-retrieve-file.pl
Product: Koha Reporter: Lari Taskula <lari.taskula>
Component: OPACAssignee: Lari Taskula <lari.taskula>
Status: Failed QA --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low    
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: Bug 41929: Enable Cache-Control for UploadedFiles
Bug 41929: Enable Cache-Control for UploadedFiles

Description Lari Taskula 2026-02-25 12:31:46 UTC
It seems unnecessary to re-fetch the files served by opac-retrieve-file.pl on each request.

Files served by opac-retrieve-file.pl are files uploaded by Tools > Uploads and marked as public.

They are each assigned a hash value, and referenced by the "id" query parameter when loaded through opac-retrieve-file.pl.

We should let browsers cache these files to reduce the load if for example these files are used by the OPAC content management to load images, fonts etc.
Comment 1 Lari Taskula 2026-02-25 19:00:54 UTC
Created attachment 193937 [details] [review]
Bug 41929: Enable Cache-Control for UploadedFiles

This patch adds Cache-Control header to Koha::UploadedFile->httpheaders.

Cache-Control is set public and max-age at 12 hours for uploaded files that are
marked as public, ie. retrieveable by opac-retrieve-file.pl. This reduces server
load as browsers are allowed to cache the files. Useful for libraries that
upload images and fonts via the upload tool, and serve them publicly in OPAC.

As for files not marked public by the upload tool, Cache-Control tells browsers
not to cache these files, as they may contain private and sensitive information.

To test:
1. prove t/db_dependent/Upload.t
Comment 2 Laura Escamilla 2026-02-26 16:16:54 UTC
Created attachment 194015 [details] [review]
Bug 41929: Enable Cache-Control for UploadedFiles

This patch adds Cache-Control header to Koha::UploadedFile->httpheaders.

Cache-Control is set public and max-age at 12 hours for uploaded files that are
marked as public, ie. retrieveable by opac-retrieve-file.pl. This reduces server
load as browsers are allowed to cache the files. Useful for libraries that
upload images and fonts via the upload tool, and serve them publicly in OPAC.

As for files not marked public by the upload tool, Cache-Control tells browsers
not to cache these files, as they may contain private and sensitive information.

To test:
1. prove t/db_dependent/Upload.t

Signed-off-by: Laura_Escamilla <laura.escamilla@bywatersolutions.com>
Comment 3 Lari Taskula 2026-02-27 08:53:17 UTC
(In reply to Lari Taskula from comment #1)
> As for files not marked public by the upload tool, Cache-Control tells browsers
> not to cache these files, as they may contain private and sensitive information.
In some cases files marked as public may as well contain sensitive information and caching them on the disk may go against your organization's security policies. This would of course require OPAC being restricted from public access in the first place.

Perhaps it's better to add the uploaded file a new setting that when checked, allows the file to be cached. The default would be not to cache the files.