Stop Forcing must-revalidate header about aws-s3 HOT 3 CLOSED

Why does there need to be another reason? I'm sure the audit team had good reason to add this warning. You may not be fully understanding the implications of this header. See this stackoverflow post for example:

The must-revalidate directive ought to be used by servers if and only if failure to validate a request on the representation could result in incorrect operation, such as a silently unexecuted financial transaction.

A secondary reason though would just be the principle of control - i ought to be the one determining what headers i do and don't include in my server responses not the system.

Lastly - what if a person explicitly does not want to require the browser to get a fresh version after 30 days. Why force this on people?

from aws-s3.

Better late than never!

The must-revalidate header no longer gets added to uploads, as that is, indeed, not exactly suited for this scenario.

from aws-s3.

Besides Chrome audit complaining, why is that header a problem?

All it's doing is telling the browser "once the 30 days are up, you MUST get a fresh version".

An event for the metadata is a good idea for a general extensibility, but I'm curious whether there's an actual problematic scenario or not that you're having.

from aws-s3.