yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(api): Implement API response Cache-Control

Browse Source 
- Introduce `withCacheControl` utility function for API responses.
- Apply `private, no-store` to authentication and data modification (POST, PATCH, DELETE) routes.
- Apply `private, no-cache` to sensitive data retrieval (GET) routes.
- Enhance security by preventing caching of private user data.
- Ensure fresh data is always fetched for authenticated API responses.
This commit is contained in:
Yusuf İpek
2026-02-07 16:51:46 +03:00
parent 669f6fa9d2
commit 6e8170d080
24 changed files with 179 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/comments/[commentId]/route.ts
+7 -4
View File
@@ -4,7 +4,7 @@ import { auth } from '@/lib/auth';
import { r2Client, R2_BUCKET_NAME } from '@/lib/r2';
import { DeleteObjectCommand } from '@aws-sdk/client-s3';
import { rateLimit } from '@/lib/rate-limit';
import { apiErrors, successResponse } from '@/lib/api-response';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
type RouteParams = { params: Promise<{ commentId: string }> };
@@ -56,7 +56,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
// Strip internal project data from response
const { version: _version, ...commentData } = comment;
return successResponse(commentData);
const response = successResponse(commentData);
return withCacheControl(response, 'private, no-cache');
} catch (error) {
console.error('Error fetching comment:', error);
return apiErrors.internalError('Failed to fetch comment');
@@ -137,7 +138,8 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
},
});
return successResponse(updatedComment);
const response = successResponse(updatedComment);
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error updating comment:', error);
return apiErrors.internalError('Failed to update comment');
@@ -209,7 +211,8 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
}
}
return successResponse({ message: 'Comment deleted' });
const response = successResponse({ message: 'Comment deleted' });
return withCacheControl(response, 'private, no-store');
} catch (error) {
console.error('Error deleting comment:', error);
return apiErrors.internalError('Failed to delete comment');