The technique you describe is one we have used with great success on some of our projects. However, we use longer expiration times and use the CQ4 Mapper to rewrite the URLs when new versions of static application resources such as CSS, JS, PNG are published.

I have written a little bit more about it on my blog:

http://cqstuff.blogspot.com/2009/11/improving-day-cq-performance-using.html

Regards,

Chris

You’re right, in reality it’s the easier way to remove parts of the cache; but if someone is misusing your system, you need tot make sure that you only remove the files, which are not requested from a “regular” user. Otherwise your cache-hit ratio in the dispatcher goes down quite dramatically and your CQ will probably overload. Then you need to think about if the dispatcher is useful at all.

So your objective is to keep garbage out of the dispatcher cache, so you don’t need to clear you dispatcher cache every once in a while.

Regarding whitelisting: Yes, it may be a pain in the ass to keep your whitelists up to date. Maybe you don’t know every selector, because they are dynamically created. But at one point you have to start. Security isn’t that easy

only a few people know about the caching of the system. So i have to know that the system makes a new file on diskspace if i call the page with other selectors. –> thats the reason why I ask: Who should do that?

but your right. this is a problem, but on my opinion, there should be disk monitoring to check the disk size and if the free disk size is less than a configured amount then an automatic clean (delete dispatcher cache) should happen.

you can’t ever react on each selector/extension on this world
you will always miss some.

and you can’t garantie that each techie now about the whitelist. sometime there should be a fast reaction on a problem an then you will forget it.

and an implementation of a whitelist, costs a lot of money and as shown above you can’t get everything

a monitoring & cleaning version costs perhaps a tool or 1 day of configuration and thats it

Why would one ever trying to login using the root-account on a foreign computer for which he hasn’t the allowance to do so? Why would some people running denial of service actions against internet websites? If there’s a possibility to misuse a feature, people will sooner or later misuse it, usually without the knowledge of the owner …