--- title: "ADR-0010: Allow address memoization; isolate authorization and connection pooling" manual: "HTTP Guard" version: "main" permalink: "https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0010@main" source: "Adr/ADR-0010-CacheIsolationAndConcurrency.rst" rendered: "2026-10-18T14:31:38+00:00" --- # ADR-0010: Allow address memoization; isolate authorization and connection pooling {#adr-0010} - *Status:* Historical proposal (original status: Proposed) - *Date:* 2026-10-08 - *Original decision makers:* Project architecture/security owners; approval still pending in the original proposal. - *Requirements:* HG-015, HG-025, HG-026, HG-027, HG-040, HG-044 - *Original supersession:* None; a new decision for the proposed product. > [!NOTE] > This is the full English translation of the historical proposal dated > 2026-10-08, originally Proposed. Its pending approval is historical and > creates no additional alpha approval gate. Current > [Security model and limits](https://docs.typo3.org/permalink/netresearch/nr-http-guard:security@main), [Development and tests](https://docs.typo3.org/permalink/netresearch/nr-http-guard:development@main), [Verification report](https://docs.typo3.org/permalink/netresearch/nr-http-guard:verification-report@main) and > [Requirements and security invariants](https://docs.typo3.org/permalink/netresearch/nr-http-guard:development-requirements@main) describe the operative scope and evidence. > > The later single-package decision is recorded in [ADR-0015: One installable extension](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0015@main). ## Context {#adr-0010-context} Concurrent requests may reach the same origin under different permissions or DNS answers. Guzzle/cURL pooling and optional share handles may reuse DNS or connection state. A new pin alone therefore does not sufficiently demonstrate request-specific isolation. Sources: `[S12, S14]`. ## Decision {#adr-0010-decision} Version 1 isolates each independent transfer lease, including its cURL multi handle, DNS and connection state. No shared share handles, no adoption of foreign pooled connections and no silent Alt-Svc or HSTS route changes. A request with an internal grant must not privilege a later public request through its connection pool. A bounded positive DNS memo is permitted: by default at most five seconds and 32 hosts, or less when a shorter TTL is known. TTL 0 and negative answers are not positively cached. Keys include resolver identity/configuration. Every use classifies addresses again against current policy; a boolean allow is never cached. ConnectionPlans are single-use, short-lived attempt data. Deferred work is authorized on the actual new attempt, not when scheduled. Policy changes apply to new attempts; already running allowed transfers are not presented as automatically revoked. ## Rejected alternatives {#adr-0010-rejected-alternatives} - **Shared pool plus a pin:** requires additional, complex isolation evidence. - **Global host-allow cache:** mixes contexts. - **No memoization at all:** safely possible, but causes avoidable duplicate resolution. - **Live revocation of running transfers:** a separate runtime feature, not accomplished by flushing a cache. ## Consequences {#adr-0010-consequences} Parallel security decisions remain independent. v1 forgoes reuse between independent attempts and accepts handshake costs. These costs must be measured at high request volumes; the library does not buffer bodies additionally. ## Evidence and acceptance in the original proposal {#adr-0010-verification-and-acceptance} `T038, T052, T053, T054, T055, T056, T057, T075, T079, T084`. Details and expected results are in [Original verification specification](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/06-verification.md). These tests were specified, not executed as part of the original documentation delivery. ## Reasons to reconsider {#adr-0010-reassessment-trigger} Pooling may be introduced only after a new ADR with a key/invalidation model, concurrency tests and wire evidence. A performance objective alone is not evidence. ## Related documents {#adr-0010-related-documents} [Original ADR](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/adr/ADR-0010-cache-isolation-und-parallelitaet.md), [Original product requirements](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/01-product-requirements.md), [Original security model](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/02-security-model.md), [Original architecture](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/03-architecture.md) and [Original source catalogue](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/08-evidence-and-sources.md) (`S01-S23`), plus the [ADR index](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-index@main). [Original sources](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-original-sources@main) explains the immutable source index.