Download as
Browse Code »

Commit 191cbc164829db70588c9a6569eec981eb18becf

Authored by Antonio Terceiro
1 parent 62419e2b
Exists in master and in 29 other branches add_member_task_reject_details, admin_visible_profile, article-list-template, community_notifications, contact_admin_translation, event_fixes, fix_comments_pagination, fix_rails4_organization_ratings, fix_sign_up_form, follow_step_fix, forum_topic_creation, mirror_block_improvements, multi_env_on_remote_user, new_security, noosfero_spb_ci, organization_ratings_improvements, organization_ratings_link_to_profile_stable-spb-1.3, organization_ratings_translations_fix, profile_api_improvements, ratings_minor_fixes, remote_user_fix, send_email_to_admins, stable-spb-1.3, stable-spb-1.3-fixes, stable-spb-1.4, stable-spb-1.5, suggest_rejected_value, web_steps_improvements, xss_terminate_custom_options

varnish: don't leak HTTP cache headers to clients 

This fixes issues when a not-logged-id user logs in, but still sees an
old page. This is because the user's browser has cached the page due to
having received it with 'Cache-Control: public, ...' headers. Now we
make varnish overwrite to always set 'Cache-Control: no-cache' so that
clients will always hit the server again.

For not-logged-in users will also always hit the server, but varnish
will still handle the requests directly for as long as it has a valid
cached version of the page.
Showing 1 changed file with 7 additions and 0 deletions   Show diff stats
etc/noosfero/varnish-noosfero.vcl
  Diff comments   View file @191cbc1
@@ -10,6 +10,13 @@ sub vcl_recv { @@ -10,6 +10,13 @@ sub vcl_recv {
10 } 10 }
11 } 11 }
12 12
  13 +sub vcl_deliver {
  14 + # Force clients to aways hit the server again for HTML pages
  15 + if (resp.http.Content-Type ~ "^text/html") {
  16 + set resp.http.Cache-Control = "no-cache";
  17 + }
  18 +}
  19 +
13 sub vcl_error { 20 sub vcl_error {
14 set obj.http.Content-Type = "text/html; charset=utf-8"; 21 set obj.http.Content-Type = "text/html; charset=utf-8";
15 22