v0.12.1-cleanups

src/api/assets.rs

@@ -24,7 +24,7 @@ async fn not_found(State(state): State<AppState>, headers: HeaderMap) -> Respons
     );
     response.headers_mut().insert(
         header::CACHE_CONTROL,
-        HeaderValue::from_static("private, no-store, no-cache, must-revalidate"),
+        HeaderValue::from_static("private, no-store, no-cache"),
     );
     response
 }
@@ -49,7 +49,7 @@ async fn index(State(state): State<AppState>, headers: HeaderMap) -> Response {
     );
     response.headers_mut().insert(
         header::CACHE_CONTROL,
-        HeaderValue::from_static("private, no-store, no-cache, must-revalidate"),
+        HeaderValue::from_static("private, no-store, no-cache"),
     );
     response
 }
@@ -98,13 +98,6 @@ async fn theme_init_js() -> Response {
         "public, max-age=31536000, immutable",
     )
 }
-async fn theme_init_js_legacy() -> Response {
-    static_response(
-        THEME_INIT_JS,
-        "application/javascript; charset=utf-8",
-        "no-cache",
-    )
-}
 async fn styles_css() -> Response {
     static_response(
         STYLES_CSS,
@@ -112,9 +105,6 @@ async fn styles_css() -> Response {
         "public, max-age=31536000, immutable",
     )
 }
-async fn styles_css_legacy() -> Response {
-    static_response(STYLES_CSS, "text/css; charset=utf-8", "no-cache")
-}
 async fn manifest() -> Response {
     static_response(
         MANIFEST,
@@ -160,7 +150,7 @@ async fn preset_index() -> Response {
     static_response(
         PRESET_MANIFEST_JSON,
         "application/json; charset=utf-8",
-        "no-cache",
+        "no-cache, no-store",
     )
 }
 async fn preset_file(Path(file): Path<String>) -> Response {

src/api/middleware.rs

@@ -1,6 +1,10 @@
 async fn security_headers(request: Request, next: Next) -> Response {
-    let is_api = request.uri().path().contains("/api/");
+    let path = request.uri().path();
+    let is_api = path == "/api" || path.starts_with("/api/");
+    let is_api_docs = path == "/api-docs" || path.starts_with("/api-docs/");
+
     let mut response = next.run(request).await;
+
     let is_html = response
         .headers()
         .get(header::CONTENT_TYPE)
@@ -13,6 +17,7 @@ async fn security_headers(request: Request, next: Next) -> Response {
         });
 
     let headers = response.headers_mut();
+
     headers.insert(
         header::HeaderName::from_static("x-content-type-options"),
         HeaderValue::from_static("nosniff"),
@@ -27,7 +32,12 @@ async fn security_headers(request: Request, next: Next) -> Response {
             header::HeaderName::from_static("x-frame-options"),
             HeaderValue::from_static("SAMEORIGIN"),
         );
-        headers.insert(header::HeaderName::from_static("content-security-policy"), HeaderValue::from_static("default-src 'self'; connect-src 'self' ws: wss:; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'"));
+        headers.insert(
+            header::HeaderName::from_static("content-security-policy"),
+            HeaderValue::from_static(
+                "default-src 'self'; connect-src 'self' ws: wss:; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; object-src 'none'"
+            ),
+        );
         headers.insert(
             header::HeaderName::from_static("permissions-policy"),
             HeaderValue::from_static("camera=(), microphone=(), geolocation=()"),
@@ -35,7 +45,16 @@ async fn security_headers(request: Request, next: Next) -> Response {
     }
 
     if is_api {
-        headers.insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
+        headers.insert(
+            header::CACHE_CONTROL,
+            HeaderValue::from_static("no-cache, no-store"),
+        );
+    } else if is_api_docs {
+        headers.insert(
+            header::CACHE_CONTROL,
+            HeaderValue::from_static("no-cache, must-revalidate"),
+        );
     }
+
     response
 }