Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-27 09:06:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): explicitly set cache-control 'private' on any page where a header is built

Browse Source
This commit is contained in:
Julian Lam
2022-03-17 16:24:03 -04:00
parent 5f36ad3976
commit e39cdd490b
2 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/middleware/admin.js
View File

@@ -25,6 +25,8 @@ middleware.buildHeader = helpers.try(async (req, res, next) => {
if (req.method === 'GET') { if (req.method === 'GET') {
await require('./index').applyCSRFasync(req, res); await require('./index').applyCSRFasync(req, res);
} }
res.set('cache-control', 'private');
res.locals.config = await controllers.api.loadConfig(req); res.locals.config = await controllers.api.loadConfig(req);
next(); next();
}); });

5
src/middleware/header.js
View File

@@ -44,6 +44,11 @@ middleware.buildHeader = helpers.try(async (req, res, next) => {
req.logout(); req.logout();
return res.redirect('/'); return res.redirect('/');
} }
if (req.loggedIn) {
res.set('cache-control', 'private');
}
res.locals.config = config; res.locals.config = config;
next(); next();
}); });