Web-hook Example to Invalidate Cache

Overview

This page demonstrates how to invalidate the resource data cache using a web hook.

Use Case

By default, the ResourceResolver component in the demo project caches product catalog data for one minute. The cache key includes the resource space name, operation name, relative resource path, and path variables. As long as the cache entry is valid (within the one-minute time-to-live), repeated requests return cached data without invoking the backend REST service.

If you want to increase the cache time-to-live to improve cache efficiency, you may also need a way to invalidate the cache when backend data changes. Using a web hook allows you to trigger cache invalidation, either partially or entirely, in response to backend updates. This approach helps maintain data consistency while maximizing performance.

Example: Basic Web Hook Page

The demo project includes a simple web hook implementation, invalidate-cache.jsp, for demonstration purposes. This example shows how to implement a web hook endpoint as a JSP page, servlet, or similar component.

You can invoke the demo web hook page with two POST parameters: one for the target resource space name and one for a minimal "secret" for authentication.

$ curl http://localhost:8080/site/examples/invalidate-cache.jsp \
    -d "resource_space=demoProductCatalogs&secret=some_secret"
copy

The example JSP page below reads the POST parameters, checks the secret, and clears the cache for the specified resource space by calling ResourceServiceBroker#getResourceDataCache(resourceSpace).clear().

<%--
  Simple ResourceDataCache invalidation example for a resource space.
  This simple JSP page reads two post request parameters, "resource_space" and "secret",
  and clears the associated ResourceDataCache specified by the "resource_space" parameter value.
  For simplicity, this page compares the "secret" parameter with a hard-coded secret string for security.
  In practice, you will probably want to keep the secret in a different store for security, maintainability, etc.
--%>
<%@ page language="java" %>
<%@ page import="javax.servlet.http.HttpServletResponse" %>
<%@ page import="org.slf4j.LoggerFactory" %>
<%@ page import="org.slf4j.Logger" %>
<%@ page import="org.onehippo.cms7.crisp.api.broker.ResourceServiceBroker" %>
<%@ page import="org.onehippo.cms7.crisp.api.resource.ResourceDataCache" %>
<%@ page import="org.onehippo.cms7.crisp.hst.module.CrispHstServices" %>
 
<%!
private static final String DEFAULT_SECRET = "some_secret";
 
private static Logger log = LoggerFactory.getLogger("org.onehippo.cms7.crisp.demo.jsp.invalidate-cache");
%>
 
<%
if (!"POST".equals(request.getMethod())) {
    log.error("Must be a POST request.");
    response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
    return;
}
 
String resourceSpace = request.getParameter("resource_space");
String secret = request.getParameter("secret");
 
if (resourceSpace == null || "".equals(resourceSpace.trim())) {
    log.error("Resource space name is missing.");
    response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
    return;
}
 
if (!DEFAULT_SECRET.equals(secret)) {
    log.error("Wrong secret.");
    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
    return;
}
 
ResourceServiceBroker broker = CrispHstServices.getDefaultResourceServiceBroker(HstServices.getComponentManager());
 
if (broker == null) {
    log.error("CRISP was not initialized.");
    response.setStatus(HttpServletResponse.SC_NOT_FOUND);
    return;
}
 
ResourceDataCache resourceDataCache = broker.getResourceDataCache(resourceSpace);
 
if (resourceDataCache == null) {
    log.error("No resource data cache for the resource space.");
    response.setStatus(HttpServletResponse.SC_NOT_FOUND);
    return;
}
 
log.info("Resource data cache cleared for resource space: '{}'", resourceSpace);
resourceDataCache.clear();
out.println("Resource data cache cleared for resource space: '" + resourceSpace + "'.");
%>
copy

Note:
This example uses a hard-coded secret for simplicity. In production, store secrets securely and follow best practices for authentication and authorization.