From dfd045919fc30eb9d032a87b781a83b37c9f372f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mateusz=20Gruszczy=C5=84ski?=
 <mateusz.gruszczynski@firma.interia.pl>
Date: Sun, 2 Aug 2026 01:03:13 +0200
Subject: [PATCH] wyklucz ikouny z nagowkow

---
 src/app/mod.rs   | 19 +++++++++++++++----
 src/app/pages.rs |  2 +-
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/src/app/mod.rs b/src/app/mod.rs
index 22f7f0b..aba89b8 100644
--- a/src/app/mod.rs
+++ b/src/app/mod.rs
@@ -10,8 +10,7 @@
 mod pages;
 
 use axum::{
-    Json,
-    Router,
+    Json, Router,
     extract::{DefaultBodyLimit, Request},
     http::{HeaderName, HeaderValue, Method, StatusCode, header},
     middleware::{self, Next},
@@ -76,7 +75,10 @@ pub fn router(
             get(api::download_legacy_file),
         )
         .route("/api/auth/identity", post(auth::identity))
-        .route("/api/security/csrf", get(crate::security::csrf_token_endpoint))
+        .route(
+            "/api/security/csrf",
+            get(crate::security::csrf_token_endpoint),
+        )
         .route("/api/access-token", post(api::create_resource_access_token))
         .route("/api/auth/register", post(auth::register))
         .route("/api/auth/login", post(auth::login))
@@ -248,8 +250,14 @@ async fn require_csrf_token(request: Request, next: Next) -> Response {
 
 async fn add_non_asset_security_headers(request: Request, next: Next) -> Response {
     let path = request.uri().path();
+
     let is_asset = path.starts_with("/assets/");
     let is_file = path.starts_with("/f/");
+    let is_icon = matches!(
+        path,
+        "/favicon.svg" | "/favicon.ico" | "/favicon-32.png" | "/apple-touch-icon.png"
+    );
+
     let mut response = next.run(request).await;
 
     if is_file {
@@ -259,14 +267,17 @@ async fn add_non_asset_security_headers(request: Request, next: Next) -> Respons
         headers.remove("cross-origin-resource-policy");
         headers.remove("referrer-policy");
         headers.remove("permissions-policy");
-    } else if !is_asset {
+    } else if !is_asset && !is_icon {
         let headers = response.headers_mut();
+
         headers
             .entry("x-content-type-options")
             .or_insert(HeaderValue::from_static("nosniff"));
+
         headers
             .entry("referrer-policy")
             .or_insert(HeaderValue::from_static("strict-origin-when-cross-origin"));
+
         headers
             .entry("permissions-policy")
             .or_insert(HeaderValue::from_static(
diff --git a/src/app/pages.rs b/src/app/pages.rs
index f1ea51b..82d280d 100644
--- a/src/app/pages.rs
+++ b/src/app/pages.rs
@@ -76,7 +76,7 @@ pub(super) async fn favicon() -> Response {
             ),
             (
                 header::CACHE_CONTROL,
-                HeaderValue::from_static("public, max-age=604800"),
+                HeaderValue::from_static("public, max-age=604800, must-revalidate"),
             ),
         ],
         FAVICON,