Only cache-invalidate genuinely-invalid keys, not origin-denied (prevents valid-key DoS)

Shipped

July 15, 2026 at 11:42 PM UTC

Author

Kamo

Commit

0896154

On a cold Redis cache, a valid public-chat key with a wrong/absent Origin was cached as INVALID for 60s, denying the correct origin's requests for that window. Both the HTTP and WebSocket cold-cache fallbacks now distinguish **************** null return (genuinely invalid/inactive key or downstream error - safe to cacheInvalid) from a ValidationResult(valid=false, ...) return (valid key, origin denied - reject this request only, cache left untouched).