[unregistereddev]

Even when etag's have nothing to do with the filesystem they can still be a security vector. Some API's use etag's to identify what has changed since the last time you called a particular API. This means the ETAG values are probably stored in a database, which means the API server needs to protect against SQL injection in the request headers.

[mikevin]

I mean that's something you need to do every time a DB is involved. Not really an argument against ETAGS.