[pas]

Huh? Do XHR requests go on the navigation history stack? WTF? Why? And why would any site use the same URIs for API endpoints and frontend/view navigation places? And in that case should the Content-Type (or Accepts) be the main factor?

[glitchdout]

> Why would any site use the same URIs for API endpoints and frontend/view navigation places?

Simplicity. Ruby on Rails facilitates that approach, for example.

> And in that case should the Content-Type (or Accepts) be the main factor?

Content-Type, yup! Unfortunately Chrome and IE 10 (not sure about Edge) disagree on that.

Without the Vary header, the back button leads to rendering what the server last returned, without taking the Content-Type into account - which is completely nonsensical in my opinion.

Chromium bug: https://bugs.chromium.org/p/chromium/issues/detail?id=94369

Repo and page that demonstrate the issue: https://github.com/guilhermesimoes/chrome-bug

This has been going on since at least 2011 so it seems nobody cares.

I honestly do not understand why that Vary header is necessary.

Firefox doesn't seem to need it to render pages from its cache correctly.

[Ajedi32]

Ironically, the section of the HTTP spec they initially referenced in that Chrome bug as justification for closing it as WontFix is precisely the part which explains why Chrome's current behavior is incorrect. Specifically:

> History mechanisms and caches are different. In particular history mechanisms SHOULD NOT try to show a semantically transparent view of the current state of a resource. Rather, a history mechanism is meant to show exactly what the user saw at the time when the resource was retrieved.

Doesn't matter whether a Vary header is sent or not; when a user clicks the back button they should see exactly what they saw when they previously viewed that page; regardless of whether that content is cached or not.

[untog]

No, I think the OP is suggesting that the same URL will have been requested in both JSON and HTML formats, and the browser cache is not differentiating between them.

[pas]

Yes, I understand that, but that seems crazy on multiple levels.

Why the X-Requested-With should be in Vary when the same client did the request? (Yes, I see, Ajax libs populate this field, whereas usual browser navigation doesn't. Makes no sense.)

Why is that resource in cache anyhow, when it should be Cache-Control: no-cache (or at least must-revalidate, but it probably is, but of course that again means that the cache returns the JSON after getting the 304 from the backend, because it doesn't differentiate between responses with different Content-Type)?

It seems to me that the X-Requested-With is again a hack on top of "representational state transfer", because it was easier than trying to use Content-Type.

[tommorris]

> And why would any site use the same URIs for API endpoints and frontend/view navigation places?

Because they are the same underlying thing...

[pas]

Yes, of course, but not exactly.

I mean, I know RoR likes magic very much, but it's not totally surprising to separate the backend from the frontend.

And then use a SPA framework and use Ajax to communicate with the backend via a "REST API", because that simplifies the backend. A lot. You don't have to have views, templates, and so on implemented.

So either the REST API is not a REST API, but a lot of interesting endpoints for the frontend dynamic JS magic, or the frontend is not a frontend, just a lot of glitter thrown up on a REST API.

(I quickly tried to get something in JSON from a GitLab URL, but I just get a HTTP 406. :( )