[TYPO3-dev] Caching extension output without the cHash parameter

[John de Stigter]

> Subline:
> 
> The cHash way is easier to do and security tested. 
> 
> Fortunately I never needed to configure realUrl myself. I 
> would expect that it also hides the cHash, by "storing" it on 
> the server side. If so, why do you take the hard road?
> 
> Regards
> 
> Elmar
> 

Mentionig realUrl makes me think of a better security check that I think
is possible. I could check if the requested url exists in the realUrl
table. cHash would than only be enabled if the url exists in the table
and thus is created by the system and not by a "bad boy".

Regards,

John