[release/11.0] Don't cache truncated/aborted responses in OutputCacheMiddleware - #68773
Merged
wtgodbe merged 1 commit intoAug 25, 2026
Conversation
…otnet#68683) OutputCacheMiddleware could store a response whose body was cut short, and share that entry with requests waiting on the same cache key. FinalizeCacheBodyAsync now skips storage when the request was aborted and reports whether the response was cached. The caller releases the pending entry unless it was actually stored, so waiters re-execute instead of receiving a truncated body. Fixes dotnet#66877
Contributor
There was a problem hiding this comment.
Pull request overview
This PR backports a fix to the OutputCacheMiddleware locking/finalization path to avoid caching (and reusing for lock waiters) responses that are truncated or produced after the request is aborted, preventing partial responses from being served to other clients.
Changes:
- Updates
OutputCacheMiddlewareresponse finalization to return whether the response was actually cached, and uses that to decide whether a pending/locking entry may be reused. - Prevents caching when
HttpContext.RequestAbortedis already canceled at cache-body finalization time. - Adds/extends unit tests covering aborted responses and truncated responses under locking.
Show a summary per file
| File | Description |
|---|---|
| src/Middleware/OutputCaching/src/OutputCacheMiddleware.cs | Makes cache-body finalization report cache success and prevents caching when the request is already aborted; releases pending entries when not cached. |
| src/Middleware/OutputCaching/test/OutputCacheMiddlewareTests.cs | Adds tests for “don’t cache on aborted request” and for ignoring truncated responses under locking. |
Review details
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Lite
Comment on lines
+1184
to
+1188
| [Fact] | ||
| public async Task AbortedRequest_IsNotServedToSubsequentRequests() | ||
| { | ||
| var responseCounter = 0; | ||
| var cache = GetStore(); |
Comment on lines
447
to
451
| await OutputCacheEntryFormatter.StoreAsync(context.CacheKey, context.CachedResponse, context.Tags, context.CachedResponseValidFor, | ||
| _store, _logger, context.HttpContext.RequestAborted); | ||
|
|
||
| return true; | ||
| } |
Member
|
Approved over email |
Contributor
|
Hi @DeagleGross. This PR was just approved to be included in the upcoming servicing release. Somebody from the @dotnet/aspnet-build team will get it merged when the branches are open. Until then, please make sure all the CI checks pass and the PR is reviewed. |
wtgodbe
approved these changes
Aug 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #68683 to release/11.0
Don't cache truncated/aborted responses in OutputCacheMiddleware
Description
Prevents
OutputCacheMiddlewarefrom storing responses after the request is aborted, and only shares a response with requests waiting on the same cache key when the response was actually cached. Waiters now re-execute the pipeline instead of receiving a truncated or aborted response.Fixes #66877
Fixes #56427
Customer Impact
Without this fix, an aborted request can cache a partial response and serve it to subsequent clients until the cache entry expires. Requests waiting through output-cache locking can also receive a truncated in-flight response.
Regression?
Risk
The change is isolated to output-cache response finalization and pending-request reuse, with targeted automated coverage for aborted and truncated responses.
Verification
Microsoft.AspNetCore.OutputCaching.Testspasses on net11.0 with native builds disabled.Packaging changes reviewed?
When servicing release/2.3