fizzy

bterkuile/fizzy

Fork 0

Commit Graph

Author	SHA1	Message	Date
Mike Dalessio	628571fc79	Don't set public Cache-Control on proxied non-public blobs Rails' ActiveStorage proxy controllers hardcode `http_cache_forever public: true`, which sets `Cache-Control: public, immutable`. For non-public blobs behind auth, this allows CDN caching that serves responses without authorization checks. Override `http_cache_forever` in the Authorize concern to downgrade `public` to `false` for non-public blobs. See https://github.com/basecamp/fizzy/pull/2251 for context	2026-03-26 14:58:40 -04:00
Rosa Gutierrez	196d685f8d	Implement authorization for Active Storage endpoints Consider blobs attached to any public records accessible to anyone with the URL.	2025-12-25 21:22:36 +01:00

Author

SHA1

Message

Date

Mike Dalessio

628571fc79

Don't set public Cache-Control on proxied non-public blobs

Rails' ActiveStorage proxy controllers hardcode `http_cache_forever public: true`,
which sets `Cache-Control: public, immutable`. For non-public blobs behind auth,
this allows CDN caching that serves responses without authorization checks.

Override `http_cache_forever` in the Authorize concern to downgrade `public` to
`false` for non-public blobs.

See https://github.com/basecamp/fizzy/pull/2251 for context

2026-03-26 14:58:40 -04:00

Rosa Gutierrez

196d685f8d

Implement authorization for Active Storage endpoints

Consider blobs attached to any public records accessible to anyone with
the URL.

2025-12-25 21:22:36 +01:00

2 Commits