Issue: Google PageSpeed breaks attachments

For a quick fix, you can add the following to the domains root .htaccess file.

<IfModule pagespeed_module>
ModPagespeedDisallow */wiki_index-asset/*
</IfModule>

In general, Pagespeed should not be used to cache any attachment content that is served dynamically via a PHP script. These resources tend to return different output based on the user's permissions. If the current visitor has different permissions than when it was cached, or if the pagespeed process is treated as a guest and guests don't have permission, then you can have issues like you experienced.

The only way to fix this is to configure PageSpeed to ignore wiki assets, as you have figured out. For the next release, we can make the asset script return a special header that makes pagespeed ignore it.

no-transform added to the Cache-Control headers for Asset and Image controllers. Marked as fixed in the next release.

Would it be possible to get that header optional?

We were looking way too long into why the /wiki-assets/ weren't optimized by the pagespeed module, and it turned out to be because the Cache-Control header is set with "private" and "no-transform"

In our case the images/wikis are all public anyway so doesn't matter about permissions.. Also, couldn't VW check if the image is public or not before adding those in that case?

Anyway an option to disable that header for pagespeed compatibility would be nice

Pinging you here @pegasus

This request was deferred to a later date, because of the ramifications of removing no-transform that require careful consideration: If a user's permissions ever change for any reason, their access to pagespeed-cached assets would not change, which raises a security vulnerability.

It seems the best solution to this problem, when a pagespeed support option is enabled, would be to decrease the Expires header to 5 minutes and to remove the no-transform header, but to only apply these changes when the user viewing the asset is a guest. But this requires that pagespeed is aware whether the user is a guest, is able to use that information, and is able to pass that information to VaultWiki. It is not entirely clear to me yet from pagespeed's documentation how it handles user sessions and user cookies.