Commit Graph

14 Commits

Author SHA1 Message Date
Marcus Efraimsson
f778c1d971
Security: Responses from backend should not be cached (#16848)
Currently all API requests set Cache-control: no-cache to avoid browsers 
caching sensitive data. This fixes so that all responses returned from 
backend not are cached using http headers. The exception is the data proxy 
where we don't add these http headers in case datasource backend needs 
to control whether data can be cached or not.

Fixes #16845
2019-05-06 09:22:59 +02:00
Oleg Gaidarenko
67cbc7d4cf
Chore: use remote cache instead of session storage (#16114)
Replaces session storage in auth_proxy middleware with remote cache

Fixes #15161
2019-04-08 14:31:46 +03:00
Marcus Efraimsson
8029e48588
support get user tokens/revoke all user tokens in UserTokenService 2019-03-08 15:15:17 +01:00
bergquist
1310d356fc removes unused session code 2019-02-12 12:33:54 +01:00
bergquist
f257101c41 removes unused/commented code 2019-01-24 11:26:45 +01:00
bergquist
5998646da5 restrict session usage to auth_proxy 2019-01-23 14:56:48 +01:00
Marcus Efraimsson
59d0c19ba8
passing middleware tests 2019-01-22 13:51:55 +01:00
Marcus Efraimsson
81879f0162
fix broken code 2019-01-17 20:29:26 +01:00
Torkel Ödegaard
b415d82611 fixed to template PR issues, #13938 2018-11-02 10:49:46 +01:00
Julian Kornberger
7aab6a8887 Make golint happier 2018-03-22 12:40:21 +01:00
Daniel Lee
3ca1e06509 session: fork Macaron mysql session middleware
This changes forks the mysql part of the Macaron session middleware.

In the forked mysql file:

- takes in a config setting for SetConnMaxLifetime (this solves wait_timeout
problem if it is set to a shorter interval than wait_timeout)
- removes the panic when an error is returned in the Exist function.
- retries the exist query once
- retries the GC query once
2018-03-16 01:19:28 +01:00
Dan Cech
c0ecdee375
rename Context to ReqContext 2018-03-07 11:54:50 -05:00
Dan Cech
338655dd37
move Context and session out of middleware 2018-03-06 18:16:49 -05:00
Daniel Lee
0d85c63fff middleware: recovery handles panics in all handlers
Also, changes the order of the middleware so that recovery is after the
gzip middleware. Otherwise, a 200 OK is returned instead of a 500 error.
2017-11-15 13:57:33 +01:00