feat(security): #305 don't cache sensitive data #309

Merged
tim merged 1 commits from 305-tls into prod 2024-12-11 23:04:50 +00:00
2 changed files with 27 additions and 0 deletions

View File

@@ -0,0 +1,26 @@
package middleware
import (
"net/http"
"strings"
"me-fit/log"
)
func CacheControl(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
path := r.URL.Path
log.Info("path: %v", path)
cached := false
if strings.HasPrefix(path, "/static") {
cached = true
}
if !cached {
w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
}
next.ServeHTTP(w, r)
})
}

View File

@@ -128,6 +128,7 @@ func createHandler(d *sql.DB, serverSettings *types.Settings) http.Handler {
return middleware.Wrapper(
router,
middleware.Log,
middleware.CacheControl,
middleware.ContentSecurityPolicy,
middleware.Cors(serverSettings),
middleware.Authenticate(authService),