webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-28 17:02:04 +03:00
Code Activity

Forced response cache revalidation on logged-in responses

Browse Source 
- Prevents authenticated responses being visible when back button
  pressed in browser.
- Previously, 'no-cache, private' was added by default by Symfony which
  would have prevents proxy cache issues but this adds no-store and a
  max-age option to also invalidate all caching.

Thanks to @haxatron via huntr.dev
Ref: https://huntr.dev/bounties/6cda9df9-4987-4e1c-b48f-855b6901ef53/
This commit is contained in:
Dan Brown
2021-10-08 15:22:09 +01:00
parent 55be75dee2
commit 41ac69adb1
3 changed files with 42 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
tests/SecurityHeaderTest.php
View File

@ -119,6 +119,15 @@ class SecurityHeaderTest extends TestCase
$this->assertEquals('base-uri \'self\'', $scriptHeader);
}
public function test_cache_control_headers_are_strict_on_responses_when_logged_in()
{
$this->asEditor();
$resp = $this->get('/');
$resp->assertHeader('Cache-Control', 'max-age=0, no-store, private');
$resp->assertHeader('Pragma', 'no-cache');
$resp->assertHeader('Expires', 'Sun, 12 Jul 2015 19:01:00 GMT');
}
/**
* Get the value of the first CSP header of the given type.
*/