lscache 1.0.0-beta2

Recommended upgrade for all 1.0.0-beta1 users. Fixes a security-relevant correctness bug surfaced by field testing on TubeSpanner Portal: the response subscriber was emitting X-LiteSpeed-Cache-Control: public,max-age=N and X-LiteSpeed-Tag on responses that Drupal had explicitly marked uncacheable (admin pages, authenticated user pages, anything with Cache-Control: private, no-cache, or no-store).

Severity

Latent rather than active. LSWS bypasses caching when it sees a session cookie or Cache-Control: private, so no actual cache poisoning has been observed. Beta1 has been shipping the misleading directive and tags for the duration of beta1's life. The risk is that a future LSWS configuration change weakening cookie-based bypass would have caused authenticated admin responses to cache for the configured TTL with user:N cache tags, which could have served one logged-in admin's response to other users via a tag-purge race.

The fix

The response subscriber now defers to Drupal's HTTP cacheability decision via Symfony\Component\HttpFoundation\Response::isCacheable() before emitting any LSCache header. Because the subscriber runs at priority -999 (after Drupal's FinishResponseSubscriber has finalised Cache-Control), the check reflects Drupal's real decision: status code, Cache-Control directives, and Vary headers all considered.

Five new unit tests cover the cacheable, private, no-cache, no-store, and disabled-module paths in the subscriber.

Verification

To confirm the fix on your install:

1. Authenticate as an admin user.
2. Run curl -sI -A "Mozilla/5.0" -b cookiejar.txt against any admin route, direct to origin (bypassing CDN if applicable).
3. Expected: no x-litespeed-tag or x-litespeed-cache-control headers in the response.
4. Compared to beta1: those headers were present with public,max-age=N and a tag list including user:N entries.

Upgrade notes

No configuration changes needed. Composer-update to 1.0.0-beta2, run drush cr, verify per the section above. Anonymous public pages continue to receive headers as before; only previously-misleading admin/authenticated paths change.

Caveats

Still beta. Production-ready for early adopters who can monitor; soak time before 1.0.0 stable continues.

Credit for the discovery: TubeSpanner Portal admin via field testing.