Add Security Consideration about turning caching off

[msporny]

We should warn implementers that if they allow a client to turn off caching that they have to also protect themselves against DDoS attacks where clients turn off caching on purpose to make the server do a lot of network traffic. We should also note that clients should be ready to be denied when requesting that client caching is off, and should get an error back if the server refuses to turn off caching.

[gobengo]

Seems reasonable

[w3cbot]

This was discussed during the #did meeting on 17 July 2025.

View the transcript

w3c/did-resolution#149

Add Security Consideration about turning caching off #149

Wip: Perhaps Ben you can take a shot at this?

bengo: If it just adding a security consideration then I can take this on...

---

[gobengo]

@msporny wdyt of the PR I made attempting to address this issue? https://github.com/w3c/did-resolution/pull/171

[msporny]

LGTM, had some change suggestions.

[gobengo]

I accepted the changes.