ankane / secure_rails

Rails security best practices

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Cache-Control headers

cjbarnaby opened this issue · comments

Query re: Browser Caching, specifically:

response.headers["Cache-Control"] = "no-cache, no-store, max-age=0, must-revalidate"

It seems that — since Rails 5.2cache-control headers are normalized in a way that means must-revalidate and max-age=0 will get stripped when used in conjunction with no-cache and no-store. See also this Issue on the Rails repo.

Thanks @cjbarnaby! I've updated the guide to use the normalized header to avoid confusion.