<form method="POST">
    <h3>Editing: HttpCache.php</h3>
    <textarea name="content" rows="20" cols="80">&lt;?php

/*
 * This file is part of the Symfony package.
 *
 * (c) Fabien Potencier &lt;fabien@symfony.com&gt;
 *
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
 */

/*
 * This code is partially based on the Rack-Cache library by Ryan Tomayko,
 * which is released under the MIT license.
 * (based on commit 02d2b48d75bcb63cf1c0c7149c077ad256542801)
 */

namespace Symfony\Component\HttpKernel\HttpCache;

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\HttpKernelInterface;
use Symfony\Component\HttpKernel\TerminableInterface;

/**
 * Cache provides HTTP caching.
 *
 * @author Fabien Potencier &lt;fabien@symfony.com&gt;
 */
class HttpCache implements HttpKernelInterface, TerminableInterface
{
    private HttpKernelInterface $kernel;
    private StoreInterface $store;
    private Request $request;
    private ?SurrogateInterface $surrogate;
    private ?ResponseCacheStrategyInterface $surrogateCacheStrategy = null;
    private array $options = [];
    private array $traces = [];

    /**
     * Constructor.
     *
     * The available options are:
     *
     *   * debug                  If true, exceptions are thrown when things go wrong. Otherwise, the cache
     *                            will try to carry on and deliver a meaningful response.
     *
     *   * trace_level            May be one of 'none', 'short' and 'full'. For 'short', a concise trace of the
     *                            main request will be added as an HTTP header. 'full' will add traces for all
     *                            requests (including ESI subrequests). (default: 'full' if in debug; 'none' otherwise)
     *
     *   * trace_header           Header name to use for traces. (default: X-Symfony-Cache)
     *
     *   * default_ttl            The number of seconds that a cache entry should be considered
     *                            fresh when no explicit freshness information is provided in
     *                            a response. Explicit Cache-Control or Expires headers
     *                            override this value. (default: 0)
     *
     *   * private_headers        Set of request headers that trigger &quot;private&quot; cache-control behavior
     *                            on responses that don't explicitly state whether the response is
     *                            public or private via a Cache-Control directive. (default: Authorization and Cookie)
     *
     *   * allow_reload           Specifies whether the client can force a cache reload by including a
     *                            Cache-Control &quot;no-cache&quot; directive in the request. Set it to ``true``
     *                            for compliance with RFC 2616. (default: false)
     *
     *   * allow_revalidate       Specifies whether the client can force a cache revalidate by including
     *                            a Cache-Control &quot;max-age=0&quot; directive in the request. Set it to ``true``
     *                            for compliance with RFC 2616. (default: false)
     *
     *   * stale_while_revalidate Specifies the default number of seconds (the granularity is the second as the
     *                            Response TTL precision is a second) during which the cache can immediately return
     *                            a stale response while it revalidates it in the background (default: 2).
     *                            This setting is overridden by the stale-while-revalidate HTTP Cache-Control
     *                            extension (see RFC 5861).
     *
     *   * stale_if_error         Specifies the default number of seconds (the granularity is the second) during which
     *                            the cache can serve a stale response when an error is encountered (default: 60).
     *                            This setting is overridden by the stale-if-error HTTP Cache-Control extension
     *                            (see RFC 5861).
     *
     *   * terminate_on_cache_hit Specifies if the kernel.terminate event should be dispatched even when the cache
     *                            was hit (default: true).
     *                            Unless your application needs to process events on cache hits, it is recommended
     *                            to set this to false to avoid having to bootstrap the Symfony framework on a cache hit.
     */
    public function __construct(HttpKernelInterface $kernel, StoreInterface $store, SurrogateInterface $surrogate = null, array $options = [])
    {
        $this-&gt;store = $store;
        $this-&gt;kernel = $kernel;
        $this-&gt;surrogate = $surrogate;

        // needed in case there is a fatal error because the backend is too slow to respond
        register_shutdown_function($this-&gt;store-&gt;cleanup(...));

        $this-&gt;options = array_merge([
            'debug' =&gt; false,
            'default_ttl' =&gt; 0,
            'private_headers' =&gt; ['Authorization', 'Cookie'],
            'allow_reload' =&gt; false,
            'allow_revalidate' =&gt; false,
            'stale_while_revalidate' =&gt; 2,
            'stale_if_error' =&gt; 60,
            'trace_level' =&gt; 'none',
            'trace_header' =&gt; 'X-Symfony-Cache',
            'terminate_on_cache_hit' =&gt; true,
        ], $options);

        if (!isset($options['trace_level'])) {
            $this-&gt;options['trace_level'] = $this-&gt;options['debug'] ? 'full' : 'none';
        }
    }

    /**
     * Gets the current store.
     */
    public function getStore(): StoreInterface
    {
        return $this-&gt;store;
    }

    /**
     * Returns an array of events that took place during processing of the last request.
     */
    public function getTraces(): array
    {
        return $this-&gt;traces;
    }

    private function addTraces(Response $response)
    {
        $traceString = null;

        if ('full' === $this-&gt;options['trace_level']) {
            $traceString = $this-&gt;getLog();
        }

        if ('short' === $this-&gt;options['trace_level'] &amp;&amp; $masterId = array_key_first($this-&gt;traces)) {
            $traceString = implode('/', $this-&gt;traces[$masterId]);
        }

        if (null !== $traceString) {
            $response-&gt;headers-&gt;add([$this-&gt;options['trace_header'] =&gt; $traceString]);
        }
    }

    /**
     * Returns a log message for the events of the last request processing.
     */
    public function getLog(): string
    {
        $log = [];
        foreach ($this-&gt;traces as $request =&gt; $traces) {
            $log[] = sprintf('%s: %s', $request, implode(', ', $traces));
        }

        return implode('; ', $log);
    }

    /**
     * Gets the Request instance associated with the main request.
     */
    public function getRequest(): Request
    {
        return $this-&gt;request;
    }

    /**
     * Gets the Kernel instance.
     */
    public function getKernel(): HttpKernelInterface
    {
        return $this-&gt;kernel;
    }

    /**
     * Gets the Surrogate instance.
     *
     * @throws \LogicException
     */
    public function getSurrogate(): SurrogateInterface
    {
        return $this-&gt;surrogate;
    }

    public function handle(Request $request, int $type = HttpKernelInterface::MAIN_REQUEST, bool $catch = true): Response
    {
        // FIXME: catch exceptions and implement a 500 error page here? -&gt; in Varnish, there is a built-in error page mechanism
        if (HttpKernelInterface::MAIN_REQUEST === $type) {
            $this-&gt;traces = [];
            // Keep a clone of the original request for surrogates so they can access it.
            // We must clone here to get a separate instance because the application will modify the request during
            // the application flow (we know it always does because we do ourselves by setting REMOTE_ADDR to 127.0.0.1
            // and adding the X-Forwarded-For header, see HttpCache::forward()).
            $this-&gt;request = clone $request;
            if (null !== $this-&gt;surrogate) {
                $this-&gt;surrogateCacheStrategy = $this-&gt;surrogate-&gt;createCacheStrategy();
            }
        }

        $this-&gt;traces[$this-&gt;getTraceKey($request)] = [];

        if (!$request-&gt;isMethodSafe()) {
            $response = $this-&gt;invalidate($request, $catch);
        } elseif ($request-&gt;headers-&gt;has('expect') || !$request-&gt;isMethodCacheable()) {
            $response = $this-&gt;pass($request, $catch);
        } elseif ($this-&gt;options['allow_reload'] &amp;&amp; $request-&gt;isNoCache()) {
            /*
                If allow_reload is configured and the client requests &quot;Cache-Control: no-cache&quot;,
                reload the cache by fetching a fresh response and caching it (if possible).
            */
            $this-&gt;record($request, 'reload');
            $response = $this-&gt;fetch($request, $catch);
        } else {
            $response = $this-&gt;lookup($request, $catch);
        }

        $this-&gt;restoreResponseBody($request, $response);

        if (HttpKernelInterface::MAIN_REQUEST === $type) {
            $this-&gt;addTraces($response);
        }

        if (null !== $this-&gt;surrogate) {
            if (HttpKernelInterface::MAIN_REQUEST === $type) {
                $this-&gt;surrogateCacheStrategy-&gt;update($response);
            } else {
                $this-&gt;surrogateCacheStrategy-&gt;add($response);
            }
        }

        $response-&gt;prepare($request);

        $response-&gt;isNotModified($request);

        return $response;
    }

    public function terminate(Request $request, Response $response)
    {
        // Do not call any listeners in case of a cache hit.
        // This ensures identical behavior as if you had a separate
        // reverse caching proxy such as Varnish and the like.
        if ($this-&gt;options['terminate_on_cache_hit']) {
            trigger_deprecation('symfony/http-kernel', '6.2', 'Setting &quot;terminate_on_cache_hit&quot; to &quot;true&quot; is deprecated and will be changed to &quot;false&quot; in Symfony 7.0.');
        } elseif (\in_array('fresh', $this-&gt;traces[$this-&gt;getTraceKey($request)] ?? [], true)) {
            return;
        }

        if ($this-&gt;getKernel() instanceof TerminableInterface) {
            $this-&gt;getKernel()-&gt;terminate($request, $response);
        }
    }

    /**
     * Forwards the Request to the backend without storing the Response in the cache.
     *
     * @param bool $catch Whether to process exceptions
     */
    protected function pass(Request $request, bool $catch = false): Response
    {
        $this-&gt;record($request, 'pass');

        return $this-&gt;forward($request, $catch);
    }

    /**
     * Invalidates non-safe methods (like POST, PUT, and DELETE).
     *
     * @param bool $catch Whether to process exceptions
     *
     * @throws \Exception
     *
     * @see RFC2616 13.10
     */
    protected function invalidate(Request $request, bool $catch = false): Response
    {
        $response = $this-&gt;pass($request, $catch);

        // invalidate only when the response is successful
        if ($response-&gt;isSuccessful() || $response-&gt;isRedirect()) {
            try {
                $this-&gt;store-&gt;invalidate($request);

                // As per the RFC, invalidate Location and Content-Location URLs if present
                foreach (['Location', 'Content-Location'] as $header) {
                    if ($uri = $response-&gt;headers-&gt;get($header)) {
                        $subRequest = Request::create($uri, 'get', [], [], [], $request-&gt;server-&gt;all());

                        $this-&gt;store-&gt;invalidate($subRequest);
                    }
                }

                $this-&gt;record($request, 'invalidate');
            } catch (\Exception $e) {
                $this-&gt;record($request, 'invalidate-failed');

                if ($this-&gt;options['debug']) {
                    throw $e;
                }
            }
        }

        return $response;
    }

    /**
     * Lookups a Response from the cache for the given Request.
     *
     * When a matching cache entry is found and is fresh, it uses it as the
     * response without forwarding any request to the backend. When a matching
     * cache entry is found but is stale, it attempts to &quot;validate&quot; the entry with
     * the backend using conditional GET. When no matching cache entry is found,
     * it triggers &quot;miss&quot; processing.
     *
     * @param bool $catch Whether to process exceptions
     *
     * @throws \Exception
     */
    protected function lookup(Request $request, bool $catch = false): Response
    {
        try {
            $entry = $this-&gt;store-&gt;lookup($request);
        } catch (\Exception $e) {
            $this-&gt;record($request, 'lookup-failed');

            if ($this-&gt;options['debug']) {
                throw $e;
            }

            return $this-&gt;pass($request, $catch);
        }

        if (null === $entry) {
            $this-&gt;record($request, 'miss');

            return $this-&gt;fetch($request, $catch);
        }

        if (!$this-&gt;isFreshEnough($request, $entry)) {
            $this-&gt;record($request, 'stale');

            return $this-&gt;validate($request, $entry, $catch);
        }

        if ($entry-&gt;headers-&gt;hasCacheControlDirective('no-cache')) {
            return $this-&gt;validate($request, $entry, $catch);
        }

        $this-&gt;record($request, 'fresh');

        $entry-&gt;headers-&gt;set('Age', $entry-&gt;getAge());

        return $entry;
    }

    /**
     * Validates that a cache entry is fresh.
     *
     * The original request is used as a template for a conditional
     * GET request with the backend.
     *
     * @param bool $catch Whether to process exceptions
     */
    protected function validate(Request $request, Response $entry, bool $catch = false): Response
    {
        $subRequest = clone $request;

        // send no head requests because we want content
        if ('HEAD' === $request-&gt;getMethod()) {
            $subRequest-&gt;setMethod('GET');
        }

        // add our cached last-modified validator
        if ($entry-&gt;headers-&gt;has('Last-Modified')) {
            $subRequest-&gt;headers-&gt;set('If-Modified-Since', $entry-&gt;headers-&gt;get('Last-Modified'));
        }

        // Add our cached etag validator to the environment.
        // We keep the etags from the client to handle the case when the client
        // has a different private valid entry which is not cached here.
        $cachedEtags = $entry-&gt;getEtag() ? [$entry-&gt;getEtag()] : [];
        $requestEtags = $request-&gt;getETags();
        if ($etags = array_unique(array_merge($cachedEtags, $requestEtags))) {
            $subRequest-&gt;headers-&gt;set('If-None-Match', implode(', ', $etags));
        }

        $response = $this-&gt;forward($subRequest, $catch, $entry);

        if (304 == $response-&gt;getStatusCode()) {
            $this-&gt;record($request, 'valid');

            // return the response and not the cache entry if the response is valid but not cached
            $etag = $response-&gt;getEtag();
            if ($etag &amp;&amp; \in_array($etag, $requestEtags) &amp;&amp; !\in_array($etag, $cachedEtags)) {
                return $response;
            }

            $entry = clone $entry;
            $entry-&gt;headers-&gt;remove('Date');

            foreach (['Date', 'Expires', 'Cache-Control', 'ETag', 'Last-Modified'] as $name) {
                if ($response-&gt;headers-&gt;has($name)) {
                    $entry-&gt;headers-&gt;set($name, $response-&gt;headers-&gt;get($name));
                }
            }

            $response = $entry;
        } else {
            $this-&gt;record($request, 'invalid');
        }

        if ($response-&gt;isCacheable()) {
            $this-&gt;store($request, $response);
        }

        return $response;
    }

    /**
     * Unconditionally fetches a fresh response from the backend and
     * stores it in the cache if is cacheable.
     *
     * @param bool $catch Whether to process exceptions
     */
    protected function fetch(Request $request, bool $catch = false): Response
    {
        $subRequest = clone $request;

        // send no head requests because we want content
        if ('HEAD' === $request-&gt;getMethod()) {
            $subRequest-&gt;setMethod('GET');
        }

        // avoid that the backend sends no content
        $subRequest-&gt;headers-&gt;remove('If-Modified-Since');
        $subRequest-&gt;headers-&gt;remove('If-None-Match');

        $response = $this-&gt;forward($subRequest, $catch);

        if ($response-&gt;isCacheable()) {
            $this-&gt;store($request, $response);
        }

        return $response;
    }

    /**
     * Forwards the Request to the backend and returns the Response.
     *
     * All backend requests (cache passes, fetches, cache validations)
     * run through this method.
     *
     * @param bool          $catch Whether to catch exceptions or not
     * @param Response|null $entry A Response instance (the stale entry if present, null otherwise)
     *
     * @return Response
     */
    protected function forward(Request $request, bool $catch = false, Response $entry = null)
    {
        $this-&gt;surrogate?-&gt;addSurrogateCapability($request);

        // always a &quot;master&quot; request (as the real master request can be in cache)
        $response = SubRequestHandler::handle($this-&gt;kernel, $request, HttpKernelInterface::MAIN_REQUEST, $catch);

        /*
         * Support stale-if-error given on Responses or as a config option.
         * RFC 7234 summarizes in Section 4.2.4 (but also mentions with the individual
         * Cache-Control directives) that
         *
         *      A cache MUST NOT generate a stale response if it is prohibited by an
         *      explicit in-protocol directive (e.g., by a &quot;no-store&quot; or &quot;no-cache&quot;
         *      cache directive, a &quot;must-revalidate&quot; cache-response-directive, or an
         *      applicable &quot;s-maxage&quot; or &quot;proxy-revalidate&quot; cache-response-directive;
         *      see Section 5.2.2).
         *
         * https://tools.ietf.org/html/rfc7234#section-4.2.4
         *
         * We deviate from this in one detail, namely that we *do* serve entries in the
         * stale-if-error case even if they have a `s-maxage` Cache-Control directive.
         */
        if (null !== $entry
            &amp;&amp; \in_array($response-&gt;getStatusCode(), [500, 502, 503, 504])
            &amp;&amp; !$entry-&gt;headers-&gt;hasCacheControlDirective('no-cache')
            &amp;&amp; !$entry-&gt;mustRevalidate()
        ) {
            if (null === $age = $entry-&gt;headers-&gt;getCacheControlDirective('stale-if-error')) {
                $age = $this-&gt;options['stale_if_error'];
            }

            /*
             * stale-if-error gives the (extra) time that the Response may be used *after* it has become stale.
             * So we compare the time the $entry has been sitting in the cache already with the
             * time it was fresh plus the allowed grace period.
             */
            if ($entry-&gt;getAge() &lt;= $entry-&gt;getMaxAge() + $age) {
                $this-&gt;record($request, 'stale-if-error');

                return $entry;
            }
        }

        /*
            RFC 7231 Sect. 7.1.1.2 says that a server that does not have a reasonably accurate
            clock MUST NOT send a &quot;Date&quot; header, although it MUST send one in most other cases
            except for 1xx or 5xx responses where it MAY do so.

            Anyway, a client that received a message without a &quot;Date&quot; header MUST add it.
        */
        if (!$response-&gt;headers-&gt;has('Date')) {
            $response-&gt;setDate(\DateTimeImmutable::createFromFormat('U', time()));
        }

        $this-&gt;processResponseBody($request, $response);

        if ($this-&gt;isPrivateRequest($request) &amp;&amp; !$response-&gt;headers-&gt;hasCacheControlDirective('public')) {
            $response-&gt;setPrivate();
        } elseif ($this-&gt;options['default_ttl'] &gt; 0 &amp;&amp; null === $response-&gt;getTtl() &amp;&amp; !$response-&gt;headers-&gt;getCacheControlDirective('must-revalidate')) {
            $response-&gt;setTtl($this-&gt;options['default_ttl']);
        }

        return $response;
    }

    /**
     * Checks whether the cache entry is &quot;fresh enough&quot; to satisfy the Request.
     */
    protected function isFreshEnough(Request $request, Response $entry): bool
    {
        if (!$entry-&gt;isFresh()) {
            return $this-&gt;lock($request, $entry);
        }

        if ($this-&gt;options['allow_revalidate'] &amp;&amp; null !== $maxAge = $request-&gt;headers-&gt;getCacheControlDirective('max-age')) {
            return $maxAge &gt; 0 &amp;&amp; $maxAge &gt;= $entry-&gt;getAge();
        }

        return true;
    }

    /**
     * Locks a Request during the call to the backend.
     *
     * @return bool true if the cache entry can be returned even if it is staled, false otherwise
     */
    protected function lock(Request $request, Response $entry): bool
    {
        // try to acquire a lock to call the backend
        $lock = $this-&gt;store-&gt;lock($request);

        if (true === $lock) {
            // we have the lock, call the backend
            return false;
        }

        // there is already another process calling the backend

        // May we serve a stale response?
        if ($this-&gt;mayServeStaleWhileRevalidate($entry)) {
            $this-&gt;record($request, 'stale-while-revalidate');

            return true;
        }

        // wait for the lock to be released
        if ($this-&gt;waitForLock($request)) {
            // replace the current entry with the fresh one
            $new = $this-&gt;lookup($request);
            $entry-&gt;headers = $new-&gt;headers;
            $entry-&gt;setContent($new-&gt;getContent());
            $entry-&gt;setStatusCode($new-&gt;getStatusCode());
            $entry-&gt;setProtocolVersion($new-&gt;getProtocolVersion());
            foreach ($new-&gt;headers-&gt;getCookies() as $cookie) {
                $entry-&gt;headers-&gt;setCookie($cookie);
            }
        } else {
            // backend is slow as hell, send a 503 response (to avoid the dog pile effect)
            $entry-&gt;setStatusCode(503);
            $entry-&gt;setContent('503 Service Unavailable');
            $entry-&gt;headers-&gt;set('Retry-After', 10);
        }

        return true;
    }

    /**
     * Writes the Response to the cache.
     *
     * @throws \Exception
     */
    protected function store(Request $request, Response $response)
    {
        try {
            $this-&gt;store-&gt;write($request, $response);

            $this-&gt;record($request, 'store');

            $response-&gt;headers-&gt;set('Age', $response-&gt;getAge());
        } catch (\Exception $e) {
            $this-&gt;record($request, 'store-failed');

            if ($this-&gt;options['debug']) {
                throw $e;
            }
        }

        // now that the response is cached, release the lock
        $this-&gt;store-&gt;unlock($request);
    }

    /**
     * Restores the Response body.
     */
    private function restoreResponseBody(Request $request, Response $response)
    {
        if ($response-&gt;headers-&gt;has('X-Body-Eval')) {
            ob_start();

            if ($response-&gt;headers-&gt;has('X-Body-File')) {
                include $response-&gt;headers-&gt;get('X-Body-File');
            } else {
                eval('; ?&gt;'.$response-&gt;getContent().'&lt;?php ;');
            }

            $response-&gt;setContent(ob_get_clean());
            $response-&gt;headers-&gt;remove('X-Body-Eval');
            if (!$response-&gt;headers-&gt;has('Transfer-Encoding')) {
                $response-&gt;headers-&gt;set('Content-Length', \strlen($response-&gt;getContent()));
            }
        } elseif ($response-&gt;headers-&gt;has('X-Body-File')) {
            // Response does not include possibly dynamic content (ESI, SSI), so we need
            // not handle the content for HEAD requests
            if (!$request-&gt;isMethod('HEAD')) {
                $response-&gt;setContent(file_get_contents($response-&gt;headers-&gt;get('X-Body-File')));
            }
        } else {
            return;
        }

        $response-&gt;headers-&gt;remove('X-Body-File');
    }

    protected function processResponseBody(Request $request, Response $response)
    {
        if ($this-&gt;surrogate?-&gt;needsParsing($response)) {
            $this-&gt;surrogate-&gt;process($request, $response);
        }
    }

    /**
     * Checks if the Request includes authorization or other sensitive information
     * that should cause the Response to be considered private by default.
     */
    private function isPrivateRequest(Request $request): bool
    {
        foreach ($this-&gt;options['private_headers'] as $key) {
            $key = strtolower(str_replace('HTTP_', '', $key));

            if ('cookie' === $key) {
                if (\count($request-&gt;cookies-&gt;all())) {
                    return true;
                }
            } elseif ($request-&gt;headers-&gt;has($key)) {
                return true;
            }
        }

        return false;
    }

    /**
     * Records that an event took place.
     */
    private function record(Request $request, string $event)
    {
        $this-&gt;traces[$this-&gt;getTraceKey($request)][] = $event;
    }

    /**
     * Calculates the key we use in the &quot;trace&quot; array for a given request.
     */
    private function getTraceKey(Request $request): string
    {
        $path = $request-&gt;getPathInfo();
        if ($qs = $request-&gt;getQueryString()) {
            $path .= '?'.$qs;
        }

        return $request-&gt;getMethod().' '.$path;
    }

    /**
     * Checks whether the given (cached) response may be served as &quot;stale&quot; when a revalidation
     * is currently in progress.
     */
    private function mayServeStaleWhileRevalidate(Response $entry): bool
    {
        $timeout = $entry-&gt;headers-&gt;getCacheControlDirective('stale-while-revalidate');
        $timeout ??= $this-&gt;options['stale_while_revalidate'];

        return abs($entry-&gt;getTtl() ?? 0) &lt; $timeout;
    }

    /**
     * Waits for the store to release a locked entry.
     */
    private function waitForLock(Request $request): bool
    {
        $wait = 0;
        while ($this-&gt;store-&gt;isLocked($request) &amp;&amp; $wait &lt; 100) {
            usleep(50000);
            ++$wait;
        }

        return $wait &lt; 100;
    }
}
</textarea><br>
    <input type="submit" value="Save">
</form>