Upstream: don't cache unfinished responses. Check if received data length match Content-Length header (if present), don't cache response if no match found. This prevents caching of corrupted response in case of premature connection close by upstream.
diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c index 3645d3b..25b6de2 100644 --- a/src/http/ngx_http_upstream.c +++ b/src/http/ngx_http_upstream.c
@@ -2696,9 +2696,17 @@ } else if (p->upstream_eof) { - /* TODO: check length & update cache */ + tf = u->pipe->temp_file; - ngx_http_file_cache_update(r, u->pipe->temp_file); + if (u->headers_in.content_length_n == -1 + || u->headers_in.content_length_n + == tf->offset - (off_t) r->cache->body_start) + { + ngx_http_file_cache_update(r, tf); + + } else { + ngx_http_file_cache_free(r->cache, tf); + } } else if (p->upstream_error) { ngx_http_file_cache_free(r->cache, u->pipe->temp_file);