From 31ddf65a53afc2ab6ea22614183fc2210ad4fbb0 Mon Sep 17 00:00:00 2001 From: kippmorris7 Date: Mon, 10 Jul 2023 10:55:18 -0500 Subject: [PATCH] Add `Cache-Control: private, no-store` HTTP header to server endpoints that respond with sensitive info. Fixes #793 --- authority/admin/api/provisioner.go | 7 +++++++ authority/admin/api/webhook.go | 3 +++ 2 files changed, 10 insertions(+) diff --git a/authority/admin/api/provisioner.go b/authority/admin/api/provisioner.go index c584361b..41641324 100644 --- a/authority/admin/api/provisioner.go +++ b/authority/admin/api/provisioner.go @@ -55,6 +55,8 @@ func GetProvisioner(w http.ResponseWriter, r *http.Request) { render.Error(w, err) return } + + w.Header().Set("Cache-Control", "private, no-store") render.ProtoJSON(w, prov) } @@ -72,6 +74,7 @@ func GetProvisioners(w http.ResponseWriter, r *http.Request) { render.Error(w, errs.InternalServerErr(err)) return } + render.JSON(w, &GetProvisionersResponse{ Provisioners: p, NextCursor: next, @@ -102,6 +105,8 @@ func CreateProvisioner(w http.ResponseWriter, r *http.Request) { render.Error(w, admin.WrapErrorISE(err, "error storing provisioner %s", prov.Name)) return } + + w.Header().Set("Cache-Control", "private, no-store") render.ProtoJSONStatus(w, prov, http.StatusCreated) } @@ -198,6 +203,8 @@ func UpdateProvisioner(w http.ResponseWriter, r *http.Request) { render.Error(w, err) return } + + w.Header().Set("Cache-Control", "private, no-store") render.ProtoJSON(w, nu) } diff --git a/authority/admin/api/webhook.go b/authority/admin/api/webhook.go index 3939d55e..5b48a872 100644 --- a/authority/admin/api/webhook.go +++ b/authority/admin/api/webhook.go @@ -127,6 +127,7 @@ func (war *webhookAdminResponder) CreateProvisionerWebhook(w http.ResponseWriter return } + w.Header().Set("Cache-Control", "private, no-store") render.ProtoJSONStatus(w, newWebhook, http.StatusCreated) } @@ -231,5 +232,7 @@ func (war *webhookAdminResponder) UpdateProvisionerWebhook(w http.ResponseWriter Auth: newWebhook.Auth, DisableTlsClientAuth: newWebhook.DisableTlsClientAuth, } + + w.Header().Set("Cache-Control", "private, no-store") render.ProtoJSONStatus(w, whResponse, http.StatusCreated) }