mirror of
https://github.com/go-admin-team/go-admin.git
synced 2026-09-22 02:27:57 +00:00
zhangwenjian
2a900c9876
NoCache sent `no-cache, no-store, max-age=0, must-revalidate, value`. The trailing `, value` is not a directive; it is a leftover token that has been on every response this middleware touches since the file was written. Unknown directives are ignored, so nothing misbehaved because of it, but it went out on the wire and read as a mistake to anyone looking. The assertion added in #937 pins the old value, so it moves with the source: removing the token from the middleware alone turns TestNoCache red, which is the whole point of that test and the reason both lines change together here.
49 lines
1.5 KiB
Go
49 lines
1.5 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"time"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
// NoCache is a middleware function that appends headers
|
|
// to prevent the client from caching the HTTP response.
|
|
func NoCache(c *gin.Context) {
|
|
c.Header("Cache-Control", "no-cache, no-store, max-age=0, must-revalidate")
|
|
c.Header("Expires", "Thu, 01 Jan 1970 00:00:00 GMT")
|
|
c.Header("Last-Modified", time.Now().UTC().Format(http.TimeFormat))
|
|
c.Next()
|
|
}
|
|
|
|
// Options is a middleware function that appends headers
|
|
// for options requests and aborts then exits the middleware
|
|
// chain and ends the request.
|
|
func Options(c *gin.Context) {
|
|
if c.Request.Method != "OPTIONS" {
|
|
c.Next()
|
|
} else {
|
|
c.Header("Access-Control-Allow-Origin", "*")
|
|
c.Header("Access-Control-Allow-Methods", "GET,POST,PUT,PATCH,DELETE,OPTIONS")
|
|
c.Header("Access-Control-Allow-Headers", "authorization, origin, content-type, accept")
|
|
c.Header("Allow", "HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS")
|
|
c.Header("Content-Type", "application/json")
|
|
c.AbortWithStatus(200)
|
|
}
|
|
}
|
|
|
|
// Secure is a middleware function that appends security
|
|
// and resource access headers.
|
|
func Secure(c *gin.Context) {
|
|
c.Header("Access-Control-Allow-Origin", "*")
|
|
//c.Header("X-Frame-Options", "DENY")
|
|
c.Header("X-Content-Type-Options", "nosniff")
|
|
c.Header("X-XSS-Protection", "1; mode=block")
|
|
if c.Request.TLS != nil {
|
|
c.Header("Strict-Transport-Security", "max-age=31536000")
|
|
}
|
|
|
|
// Also consider adding Content-Security-Policy headers
|
|
// c.Header("Content-Security-Policy", "script-src 'self' https://cdnjs.cloudflare.com")
|
|
}
|