wyklucz ikouny z nagowkow

src/app/mod.rs

@@ -10,8 +10,7 @@
 mod pages;
 
 use axum::{
-    Json,
-    Router,
+    Json, Router,
     extract::{DefaultBodyLimit, Request},
     http::{HeaderName, HeaderValue, Method, StatusCode, header},
     middleware::{self, Next},
@@ -76,7 +75,10 @@ pub fn router(
             get(api::download_legacy_file),
         )
         .route("/api/auth/identity", post(auth::identity))
-        .route("/api/security/csrf", get(crate::security::csrf_token_endpoint))
+        .route(
+            "/api/security/csrf",
+            get(crate::security::csrf_token_endpoint),
+        )
         .route("/api/access-token", post(api::create_resource_access_token))
         .route("/api/auth/register", post(auth::register))
         .route("/api/auth/login", post(auth::login))
@@ -248,8 +250,14 @@ async fn require_csrf_token(request: Request, next: Next) -> Response {
 
 async fn add_non_asset_security_headers(request: Request, next: Next) -> Response {
     let path = request.uri().path();
+
     let is_asset = path.starts_with("/assets/");
     let is_file = path.starts_with("/f/");
+    let is_icon = matches!(
+        path,
+        "/favicon.svg" | "/favicon.ico" | "/favicon-32.png" | "/apple-touch-icon.png"
+    );
+
     let mut response = next.run(request).await;
 
     if is_file {
@@ -259,14 +267,17 @@ async fn add_non_asset_security_headers(request: Request, next: Next) -> Respons
         headers.remove("cross-origin-resource-policy");
         headers.remove("referrer-policy");
         headers.remove("permissions-policy");
-    } else if !is_asset {
+    } else if !is_asset && !is_icon {
         let headers = response.headers_mut();
+
         headers
             .entry("x-content-type-options")
             .or_insert(HeaderValue::from_static("nosniff"));
+
         headers
             .entry("referrer-policy")
             .or_insert(HeaderValue::from_static("strict-origin-when-cross-origin"));
+
         headers
             .entry("permissions-policy")
             .or_insert(HeaderValue::from_static(

src/app/pages.rs

@@ -76,7 +76,7 @@ pub(super) async fn favicon() -> Response {
             ),
             (
                 header::CACHE_CONTROL,
-                HeaderValue::from_static("public, max-age=604800"),
+                HeaderValue::from_static("public, max-age=604800, must-revalidate"),
             ),
         ],
         FAVICON,