kenmirrors/ente
1
0
Fork 0
mirror of https://github.com/ente-io/ente.git synced 2025-08-08 15:30:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

[API] Add Cache-control: no-store to API responses

Browse Source 
...instead of adding it to ad-hoc API requests.
This commit is contained in:
Manav Rathi 2024-11-27 08:16:04 +05:30
parent 4138b4da51
commit 3049c25db8
No known key found for this signature in database
5 changed files with 26 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
mobile/lib/services/collections_service.dart
View File

@ -1100,8 +1100,7 @@ class CollectionsService {
data: {"passHash": passwordHash}, data: {"passHash": passwordHash},
options: Options( options: Options(
headers: { headers: {
"X-Auth-Access-Token": authToken, "X-Auth-Access-Token": authToken
"Cache-Control": "no-cache",
}, },
), ),
); );

1
mobile/lib/utils/diff_fetcher.dart
View File

@ -30,7 +30,6 @@ class DiffFetcher {
final headers = { final headers = {
"X-Auth-Access-Token": authToken, "X-Auth-Access-Token": authToken,
"Cache-Control": "no-cache",
if (authJWTToken != null) "X-Auth-Access-Token-JWT": authJWTToken, if (authJWTToken != null) "X-Auth-Access-Token-JWT": authJWTToken,
}; };

24
server/cmd/museum/main.go
View File

@ -369,7 +369,8 @@ func main() {
return base.ServerReqID() return base.ServerReqID()
}, },
}), }),
middleware.Logger(urlSanitizer), cors(), gzip.Gzip(gzip.DefaultCompression), middleware.PanicRecover()) middleware.Logger(urlSanitizer), cors(), cacheHeaders(),
gzip.Gzip(gzip.DefaultCompression), middleware.PanicRecover())
publicAPI := server.Group("/") publicAPI := server.Group("/")
publicAPI.Use(rateLimiter.GlobalRateLimiter(), rateLimiter.APIRateLimitMiddleware(urlSanitizer)) publicAPI.Use(rateLimiter.GlobalRateLimiter(), rateLimiter.APIRateLimitMiddleware(urlSanitizer))
@ -982,6 +983,27 @@ func cors() gin.HandlerFunc {
} }
} }
func cacheHeaders() gin.HandlerFunc {
return func(c *gin.Context) {
// Add "Cache-Control: no-store" to HTTP GET API responses.
if c.Request.Method == http.MethodGet {
reqPath := urlSanitizer(c)
if strings.HasPrefix(reqPath, "/files/preview/") ||
strings.HasPrefix(reqPath, "/files/download/") ||
strings.HasPrefix(reqPath, "/public-collection/files/preview/") ||
strings.HasPrefix(reqPath, "/public-collection/files/download/") ||
strings.HasPrefix(reqPath, "/cast/files/preview/") ||
strings.HasPrefix(reqPath, "/cast/files/download/") {
// Exclude those that redirect to S3 for file downloads.
} else {
c.Writer.Header().Set("Cache-Control", "no-store")
}
}
c.Next()
}
}
var knownAPIs = make(map[string]bool) var knownAPIs = make(map[string]bool)
func urlSanitizer(c *gin.Context) string { func urlSanitizer(c *gin.Context) string {

1
web/apps/cast/src/services/render.ts
View File

@ -167,7 +167,6 @@ const getEncryptedCollectionFiles = async (
await apiURL("/cast/diff"), await apiURL("/cast/diff"),
{ sinceTime }, { sinceTime },
{ {
"Cache-Control": "no-cache",
"X-Cast-Access-Token": castToken, "X-Cast-Access-Token": castToken,
}, },
); );

5
web/apps/photos/src/services/publicCollectionService.ts
View File

@ -268,7 +268,6 @@ const getPublicFiles = async (
sinceTime: time, sinceTime: time,
}, },
{ {
"Cache-Control": "no-cache",
"X-Auth-Access-Token": token, "X-Auth-Access-Token": token,
...(passwordToken && { ...(passwordToken && {
"X-Auth-Access-Token-JWT": passwordToken, "X-Auth-Access-Token-JWT": passwordToken,
@ -320,7 +319,7 @@ export const getPublicCollection = async (
const resp = await HTTPService.get( const resp = await HTTPService.get(
await apiURL("/public-collection/info"), await apiURL("/public-collection/info"),
null, null,
{ "Cache-Control": "no-cache", "X-Auth-Access-Token": token }, { "X-Auth-Access-Token": token },
); );
const fetchedCollection = resp.data.collection; const fetchedCollection = resp.data.collection;
const referralCode = resp.data.referralCode ?? ""; const referralCode = resp.data.referralCode ?? "";
@ -372,7 +371,7 @@ export const verifyPublicCollectionPassword = async (
await apiURL("/public-collection/verify-password"), await apiURL("/public-collection/verify-password"),
{ passHash: passwordHash }, { passHash: passwordHash },
null, null,
{ "Cache-Control": "no-cache", "X-Auth-Access-Token": token }, { "X-Auth-Access-Token": token },
); );
const jwtToken = resp.data.jwtToken; const jwtToken = resp.data.jwtToken;
return jwtToken; return jwtToken;