Core Apps » Bazaar

• https://f-droid.org/repository/issues/?do=view_issue&issue=476

// Get a remote file. Returns the HTTP response code.
// If 'etag' is not null, it's passed to the server as an If-None-Match
// header, in which case expect a 304 response if nothing changed.
// In the event of a 200 response ONLY, 'retag' (which should be passed
// empty) may contain an etag value for the response, or it may be left
// empty if none was available.

The problem: The server can send unique etags, and use it as a GUID replacement.

Proposed solution: Make a HEAD request first and compare the etag with the stored one. If it does not match, then send the GET request, but without If-none-match header. This gives the server only one try to guess the etag.

See: http://lucb1e.com/rp/cookielesscookies/