Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
Code Packages Activity Actions
discourse/lib/middleware
History
Exact
discoursebot f6b777e1ba
 SECURITY: Partition anonymous cache keys by Referer for embed routes [backport 2026.7] (#42368) 
Backport of #42367 to release/2026.7.

---

## Summary

Prevent anonymous cache poisoning on embed routes by incorporating a
SHA-256 digest of the Referer header into the cache key for `/embed/`
requests. This ensures cached responses, which reflect the request
origin in the response body, are correctly partitioned by source domain.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1187

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

Co-authored-by: Mark VanLandingham <markvanlan@gmail.com>
2026-08-05 12:51:05 -05:00
..
anonymous_cache.rb SECURITY: Partition anonymous cache keys by Referer for embed routes [backport 2026.7] (#42368) 2026-08-05 12:51:05 -05:00
crawler_hooks.rb UX: Prevent incomplete crawler localization settings (#41297) 2026-07-01 12:13:22 +08:00
csp_script_nonce_injector.rb PERF: Avoid replacing CSP nonces in non-cacheable responses (#42008) 2026-07-24 09:49:01 +08:00
default_headers.rb DEV: ensure Rails application default headers are present in responses (#31619) 2025-03-05 13:19:09 +08:00
discourse_public_exceptions.rb SECURITY: Error responses missing Cache-Control header 2025-10-28 14:40:41 +08:00
enforce_hostname.rb DEV: Simplify CORS logic for public asset routes (#33106) 2025-06-09 08:58:27 +01:00
missing_avatars.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
omniauth_bypass_middleware.rb FIX: 'destination_url' cookie handling (#33072) 2025-08-06 10:09:01 +02:00
overload_protections.rb FIX: Include API key requests in overload protection bypass (#39702) 2026-05-07 12:59:11 +08:00
processing_request.rb PERF: Reject anonymous requests with 503 upon aggressive queuing (#36519) 2025-12-18 10:23:42 +08:00
request_tracker.rb FIX: Stop double-counting embedded views with beacon (#41968) 2026-07-24 13:38:00 +08:00
track_view_session_id_injector.rb FIX: Anon pageview session id reused across cached responses (#39879) 2026-05-12 10:13:05 +08:00