4

I am wanting to cache the output of the exp:store:product tag. This seems like a safe thing to do, with one possible exception. The generated form contains a hidden _params field, the value of which changes with every request. Is it safe to cache this? Or is there something I'm not considering?

4 Answers 4

3

You'll notice that the hidden _params field does change with each request (due to how the encryption works), but it is safe to cache. It's basically just an encrypted version of the Product tag parameters, so as long as your Product tag parameters don't change with each request (e.g. it contains segment variables or other dynamic variables), it's safe to cache this.

The only problem you might run into is the XID field which is generated fresh on each request and is not safe to cache. However, you can get around this by either disabling secure forms, or it's possible that CE Cache and other caching plugins take into account the XID and update it after loading the cached fragment. You would need to check with the plugin author or documentation about this. At least with the XID it will be really obvious if it is broken (every form submission after the first would break, so you would notice immediately).

1
  • @MattFordham Did you got that solved or not? I have same exact "problem" with CE Cache. Oct 10, 2014 at 21:02
2

The hidden _params field is there to encrypt any parameters you include in your Products tag. For example, if you specify some required fields then the parameters just act as an extra layer of security here to stop someone potentially modifying the form to remove the requirements upon submission. It should be safe to cache these as they generally wont change once configured but if you make any changes to the tag parameters then just be sure to clear the cache first.

1

If the hidden _params value changes with every request, surely it's not safe to cache. I don't know this definitively but it's what I would conclude.

2
  • Yeah, that's what I thought too... Oct 22, 2013 at 19:47
  • 2
    If you're considering using CE Cache, you may be able to use the {exp:ce_cache:escape} tag around the Store tags.
    – Anna_MediaGirl
    Oct 23, 2013 at 0:36
0

If you are using the Store Product Form most likely you would need to escape the form for security reasons. Otherwise you will get a security issue with the form submission.

We will work on removing this in v3.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.