[BUG] Last-Modified header is set to document date with templating apps

[cwittern]

Describe the bug

My application is using the templating framework to generate pages, they differ for every user and depend obviously on the login state. Now my users complained that they see stale pages, for example after a login change, some previously visited pages show the previous login, even if requested from the server, only a forced reload actually produces an updated page.

After investigation, I found that the Last-Modified header sent by the application is always the same as the last modified date of the HTML document that hosts the page.

Expected behavior

I would expect the Last-Modified header to be the current time at the time of the generation of the page. To work around this bug, I added the following to my controller.xql:

else if (ends-with($exist:resource, ".html")) then (
    login:set-user($config:login-domain, (), false()),
    (: the html page is run through view.xql to expand templates :)
    <dispatch xmlns="http://exist.sourceforge.net/NS/exist">
        <view>
            <forward url="{$exist:controller}/modules/view.xql">
                <set-header name="Last-Modified" value="{current-dateTime()}"/>
            </forward>
        </view>
        <error-handler>
            <forward url="{$exist:controller}/error-page.html" method="get"/>
            <forward url="{$exist:controller}/modules/view.xql"/>
        </error-handler>
    </dispatch>
)

This stops the browser from unwanted caching of pages.

To Reproduce

Unfortunately, I don't have a self-contained sample, but I think it should be easy enough to find this problem in any templating application

Context (please always complete the following information):

• OS: Ubuntu 18.04
• eXist-db Version: 5.2.0
• Java Version: 1.8.0_201
• App Version: n/a

Additional context

• How is eXist-db installed? unzipped the distribution.
• Any custom changes in e.g. conf.xml?

[joewiz]

@cwittern I believe the behavior you're describing is eXist's REST server's defaults (here, I think). In some applications this behavior might be correct, whereas others might want to determine the date based on last modified dates of the underlying data, etc. So I think this is less a bug and more a question of documenting default behavior. Perhaps we could think of a way to inform users how these dates are set by default and how to override them. Perhaps the templating (source) or urlrewrite (source) could be enriched with information about how default response headers are determined and how to override them?