github/directus
1
1
Fork 0
mirror of https://github.com/directus/directus.git synced 2026-04-25 03:00:53 -04:00
Code Issues Packages Projects Releases Wiki Activity

Set cache-control no-cache for private resources

Browse Source 
Forces the browser to revalidate the cached item with the server, ensuring you don't pull the wrong records from the browser cache.

Fixes #5175
This commit is contained in:
rijkvanzanten
2021-04-21 13:27:15 -04:00
parent c82d0b4198
commit f836c90990
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
api/src/middleware/cache.ts
View File

@@ -18,12 +18,17 @@ const checkCacheMiddleware: RequestHandler = asyncHandler(async (req, res, next)
const cachedData = await cache.get(key);
if (cachedData) {
// Set cache-control header
if (env.CACHE_AUTO_PURGE !== true) {
// Set cache-control header, but only for the public role
if (env.CACHE_AUTO_PURGE !== true && !!req.accountability?.role === false) {
const expiresAt = await cache.get(`${key}__expires_at`);
const maxAge = `max-age=${expiresAt - Date.now()}`;
const access = !!req.accountability?.role === false ? 'public' : 'private';
res.setHeader('Cache-Control', `${access}, ${maxAge}`);
res.setHeader('Cache-Control', `public, ${maxAge}`);
} else {
// This indicates that the browser/proxy is allowed to cache, but has to revalidate with
// the server before use. At this point, we don't include Last-Modified, so it'll always
// recreate the local cache. This does NOT mean that cache is disabled all together, as
// Directus is still pulling the value from it's internal cache.
res.setHeader('Cache-Control', 'no-cache');
}
return res.json(cachedData);