diff options
| author | Jan Provaznik <jprovaznik@gitlab.com> | 2018-10-24 10:13:20 +0300 |
|---|---|---|
| committer | Thiago Presa <tpresa@gitlab.com> | 2018-10-25 03:05:26 +0300 |
| commit | 5e125b0f84ad768d7ff19905d03820f561c21f98 (patch) | |
| tree | 7716189ea78f15db2282dd637d8ed0af037aac4b /app | |
| parent | e05636e2794d975876958c3781b66de2991d89d2 (diff) | |
Merge branch 'security-fix/control-headers-11-4' into 'security-11-4'
: [11.4] Resolve "Sensitive information is stored in browser history"
See merge request gitlab/gitlabhq!2562
Diffstat (limited to 'app')
| -rw-r--r-- | app/controllers/application_controller.rb | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index ec45e2813c5..ceea5f0cc26 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -44,6 +44,8 @@ class ApplicationController < ActionController::Base :git_import_enabled?, :gitlab_project_import_enabled?, :manifest_import_enabled? + DEFAULT_GITLAB_CACHE_CONTROL = "#{ActionDispatch::Http::Cache::Response::DEFAULT_CACHE_CONTROL}, no-store".freeze + rescue_from Encoding::CompatibilityError do |exception| log_exception(exception) render "errors/encoding", layout: "errors", status: 500 @@ -242,6 +244,13 @@ class ApplicationController < ActionController::Base headers['X-XSS-Protection'] = '1; mode=block' headers['X-UA-Compatible'] = 'IE=edge' headers['X-Content-Type-Options'] = 'nosniff' + + if current_user + # Adds `no-store` to the DEFAULT_CACHE_CONTROL, to prevent security + # concerns due to caching private data. + headers['Cache-Control'] = DEFAULT_GITLAB_CACHE_CONTROL + headers["Pragma"] = "no-cache" # HTTP 1.0 compatibility + end end def validate_user_service_ticket! |