Sulu Http Cache Bundle Laravel Package

Technical Evaluation

Architecture Fit

• Purpose Alignment: The alengo/sulu-http-cache-bundle targets HTTP caching optimizations for Sulu CMS (Symfony-based) by:
  • Stripping tracking query parameters (e.g., ?utm_source) to avoid cache pollution.
  • Managing CTA/marketing-attribution cookies at the reverse-proxy layer (e.g., Varnish, Nginx) to reduce payload size and improve cache efficiency.
• Symfony/Sulu Compatibility: Built for Symfony 6.4+, leveraging Symfony’s HTTP cache layer (HttpCacheStore). Fits into Sulu’s Symfony-based architecture.
• Cache Layer Integration: Works with Symfony’s HTTP cache (e.g., HttpCache middleware) and reverse proxies (Varnish/Nginx). Requires minimal changes to existing caching strategies.
• 1.0.0 Hardening Scope (new): Release 1.0.0 is a security-hardening milestone covering three surfaces:
  • Referer check hardening — stricter validation of the Referer header before trusting cache/attribution decisions, reducing cache-poisoning and forged-referer risk.
  • Cookie payload hardening — tighter validation/encoding of attribution cookie payloads (size limits, character normalization), mitigating header-injection and oversized-cookie abuse.
  • Pattern compilation hardening — safer compilation of tracking-param/cookie name patterns, reducing ReDoS / malformed-pattern risk when patterns are config-supplied.
• Significance of 1.0.0: Marks the first stable API commitment; the project is signaling it is production-ready, but teams should treat the hardening as a behavior change — stricter validation can reject payloads previously accepted.
• Key Use Cases:
  • Performance: Reduces cache invalidation noise from tracking params.
  • Marketing Analytics: Preserves attribution cookies without bloating responses.
  • Edge Caching: Enables proxy-level cookie handling for faster responses.
  • Security Posture (new): Hardened referer/cookie/pattern handling reduces cache-poisoning and injection surface.

Integration Feasibility

• Low Coupling: Bundle is self-contained (no DB changes, minimal config). Integrates via Symfony’s event system (kernel.request, kernel.response).
• Dependencies:
  • Requires Symfony 6.4+ (check Sulu version compatibility).
  • Assumes reverse proxy (Varnish/Nginx) for cookie handling at the edge.
  • No hard dependencies on Sulu-specific features (could work in vanilla Symfony).
  • 1.0.0: No new external dependencies introduced by the hardening; validation logic is internal.
• Configuration Overhead:
  • Minimal: Define sulu_http_cache in config/packages/ and configure proxy rules.
  • Example:

    sulu_http_cache:
        tracking_params: ['utm_source', 'utm_medium']  # Strip these
        proxy_cookies: ['_ga', 'marketing_attribution']  # Handle at proxy
    

  • New in 1.0.0: If referer validation is configurable, plan to declare an allow-list of trusted referers rather than relying on defaults; document accepted cookie payload constraints after hardening.
• Testing: Unit/integration tests should now additionally cover:
  • Query param stripping in responses.
  • Cookie header manipulation (including oversized and malformed payload rejection).
  • Referer allow-list / deny-list behavior (valid, absent, forged, cross-origin).
  • Pattern compilation with hostile inputs (regex-like metacharacters, very long patterns).
  • Proxy-level cookie injection (mock Varnish/Nginx).

Technical Risk

Key Questions

1. Proxy Requirements:
   • Is the target environment using Varnish/Nginx? If not, can cookies be handled at the app layer?
2. Tracking Param Scope:
   • Are all tracking params known upfront, or is dynamic detection needed?
   • New: Are configured patterns validated at build time to satisfy 1.0.0’s pattern-compilation hardening?
3. Cache Strategy:
   • How does this interact with Sulu’s ESI/HTTP cache? Could stripped params affect fragment caching?
4. Cookie Sensitivity:
   • Are marketing cookies PII? Ensure compliance with GDPR/CCPA.
   • New: What cookie payload size/encoding does 1.0.0 enforce, and does our marketing stack conform?
5. Referer Trust Model (new):
   • Which referers are treated as trusted? Is there an explicit allow-list, and does a rejected referer degrade gracefully (serve uncached vs. 4xx)?
6. Fallback Mechanism:
   • What happens if the proxy fails to handle cookies? (Graceful degradation?)
7. Monitoring:
   • How will cache hit/miss rates be tracked post-deployment?
   • New: Are we alerting on spikes in rejected referers or dropped cookie payloads post-upgrade?

Integration Approach

Stack Fit

• Primary Stack:
  • Sulu CMS (Symfony 6.4+).
  • Reverse Proxy: Varnish (recommended) or Nginx with proxy_cache.
  • HTTP Cache: Symfony’s HttpCache or Varnish cache.
• Secondary Stack:
  • Vanilla Symfony apps (if Sulu-specific features aren’t needed).
  • Not a fit for:
    • Non-Symfony apps (e.g., Laravel, Node.js).
    • Environments without a reverse proxy (cookie handling falls back to app layer).
• 1.0.0 Compatibility Note: Hardening is internal to the bundle; proxy VCL/Nginx rules from prior assessments remain valid, but referer- and cookie-validation behavior changes at the bundle layer must be re-validated end-to-end.

Migration Path

1. Pre-requisites:
   • Upgrade to Symfony 6.4+ (if not already).
   • Ensure Varnish/Nginx is configured for HTTP caching.
   • New: Audit current production cookie payloads and referer header shapes to predict 1.0.0 rejection behavior.
2. Bundle Installation / Upgrade:

   composer require alengo/sulu-http-cache-bundle:^1.0
   

   • From pre-1.0: run composer update in a staging branch, review the changelog and diff for referer/cookie/pattern logic.
3. Configuration:
   • Add bundle to config/bundles.php.
   • Configure sulu_http_cache in config/packages/sulu_http_cache.yaml.
   • New: Explicitly set referer trust configuration and validate all tracking_params / proxy_cookies patterns via a CI lint step.
4. Proxy Rules:
   • Update Varnish/Nginx to:
     • Strip tracking params from cached responses.
     • Inject marketing cookies into requests/responses.
   • Example Varnish VCL snippet:

     sub vcl_deliver {
         if (obj.http.X-Sulu-Cache-Stripped) {
             unset beresp.http.Set-Cookie;  // Let bundle handle cookies
         }
     }
     

5. Testing:
   • Unit: Test SuluHttpCacheEventSubscriber for param stripping, referer validation, and cookie payload rejection.
   • Integration: Verify proxy behavior with curl or varnishlog; include forged-referer and oversized-cookie cases.
   • E2E: Check Sulu admin panel and frontend cache consistency.
   • New: Replay a sample of production access logs through the new bundle to confirm no unintended rejections.

Compatibility

• Symfony: Confirmed for 6.4+ (check Sulu’s Symfony version).
• Sulu: Tested with Sulu’s HTTP cache layer (no conflicts reported).
• Proxies:
  • Varnish: Requires VCL adjustments (see above).
  • Nginx: Use proxy_cache_key and add_header directives.
• CDNs: May need similar cookie-stripping logic if not using Varnish.
• 1.0.0: Public API is now stable; treat future 1.x releases as additively compatible.

Sequencing

1. Phase 1: Bundle installation + basic config (no proxy changes).
   • Validate query param stripping and baseline referer/cookie validation works in-app.
2. Phase 2: Proxy integration.
   • Deploy Varnish/Nginx rules incrementally (A/B test if possible).
3. Phase 3: Marketing cookie handling.
   • Test cookie injection without breaking existing sessions; verify hardened payload acceptance.
4. Phase 4: Monitoring & hardening verification.
   • Track cache hit rates, referer rejection rate, cookie payload drop rate, and performance.

Operational Impact

Maintenance

• Bundle Updates:
  • Low effort: MIT license allows forks if upstream stalls.
  • Monitor for Symfony 7+ compatibility and for security advisories — 1.0.0 establishes a hardening precedent, expect follow-ups.
• Configuration Drift:
  • Tracking params/cookies may need updates (e.g., new UTM params).
  • New: Re-validate pattern configs after any tracking-param change; a bad pattern can now fail-fast under hardened compilation.
  • Document changes in README or wiki.
• Dependency Risks:
  • Only Symfony core dependencies (no external libraries).

Support

• Debugging:
  • Log SuluHttpCacheEvents for troubleshooting (e.g., kernel.response).
  • Proxy logs (varnishlog, Nginx error logs) for edge issues.
  • New: Log and surface rejections from referer validation and cookie payload checks — these are now first-class diagnostic signals.
• Common Issues:
  • Cookie Conflicts: Ensure marketing cookies don’t override auth sessions.
  • Cache Stampedes: Monitor if stripped params affect cache invalidation.
  • New: Post-1.0.0 upgrade, expect reports of previously-working attribution cookies being dropped or requests without referers being treated as uncacheable; pre-document expected behavior.
• Support Channels:
  • Limited community (0 stars/dependents); rely on:
    • GitHub issues.
    • Symfony/Sulu Slack/Discord groups.

Scaling

• Performance:
  • Expected: Reduced cache invalidations → higher hit rates.
  • Edge Cases:
    • High traffic: Proxy may become bottleneck (scale Varnish/Nginx).
    • Dynamic cookies: App-layer fallback increases payload size.
• Horizontal Scaling:
  • Stateless design; scales with Symfony/Sulu.
  • Proxy must handle cookie injection at scale (test with load tools like wrk).
• Cost:
  • No additional infrastructure costs (uses existing proxy/cache).

Failure Modes

Ramp-Up

• Team Skills:
  • Required: Symfony event listeners, Varnish/Nginx basics.
  • Nice-to-have: HTTP caching deep dive (e.g., Cache-Control headers).
  • New: Familiarity with security-hardening implications for referer validation and cookie parsing (header injection, ReDoS).
• Onboarding:
  1. Workshop: 1-hour session on:
     • Symfony event system.
     • Proxy-level caching.
     • 1.0.0 hardening behavior and its regression surface.
  2. Docs: Add to internal wiki with:
     • Config examples.
     • Proxy VCL/Nginx snippets.
     • Troubleshooting checklist (including referer and cookie rejection runbooks).
  3. Training:
     • Hands-on lab: Deploy to staging with mock tracking params, forged referers, and oversized cookies.
• Knowledge Transfer:
  • Assign a proxy caching SME to review VCL.
  • New: Assign a security reviewer to sign off on referer allow-lists and cookie payload rules for 1.0.0.