tarrien/Mastodon
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix Vary parsing in cache control enforcement (#37426)

Browse Source
This commit is contained in:
Joshua Rogers 2026-01-10 03:21:18 +11:00 committed by GitHub
parent b35b3a8bcc
commit b55982cc1a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/concerns/cache_concern.rb
View File

@ -19,7 +19,7 @@ module CacheConcern
# from being used as cache keys, while allowing to `Vary` on them (to not serve # from being used as cache keys, while allowing to `Vary` on them (to not serve
# anonymous cached data to authenticated requests when authentication matters) # anonymous cached data to authenticated requests when authentication matters)
def enforce_cache_control! def enforce_cache_control!
vary = response.headers['Vary']&.split&.map { |x| x.strip.downcase } vary = response.headers['Vary'].to_s.split(',').map { |x| x.strip.downcase }.reject(&:empty?)
return unless vary.present? && %w(cookie authorization signature).any? { |header| vary.include?(header) && request.headers[header].present? } return unless vary.present? && %w(cookie authorization signature).any? { |header| vary.include?(header) && request.headers[header].present? }
response.cache_control.replace(private: true, no_store: true) response.cache_control.replace(private: true, no_store: true)