From d9f58fb90e36af187251084c3b54025aeb34c784 Mon Sep 17 00:00:00 2001 From: IK Date: Wed, 16 Sep 2026 19:57:05 +0700 Subject: [PATCH] fix: harden admin page cache headers --- apps/web/src/layouts/Layout.astro | 7 ++++++- deploy/probe-admin-auth.py | 4 ++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/apps/web/src/layouts/Layout.astro b/apps/web/src/layouts/Layout.astro index eb4cdfb..592fcc2 100644 --- a/apps/web/src/layouts/Layout.astro +++ b/apps/web/src/layouts/Layout.astro @@ -32,7 +32,12 @@ const theme = storedTheme === "light" || storedTheme === "dark" ? storedTheme : const siteUrl = import.meta.env.PUBLIC_SITE_URL || "https://rf4spotter.ru"; const canonical = new URL(path, siteUrl).toString(); const socialImage = new URL(image, siteUrl).toString(); -const preventIndexing = noindex || path === "/admin" || path.startsWith("/admin/"); +const isAdminPath = path === "/admin" || path.startsWith("/admin/"); +const preventIndexing = noindex || isAdminPath; +if (isAdminPath) { + Astro.response.headers.set("Cache-Control", "private, no-store"); + Astro.response.headers.set("X-Robots-Tag", "noindex, nofollow"); +} const websiteJsonLd = { "@type": "WebSite", name: "RF4 Spotter", url: siteUrl, inLanguage: "ru" }; // A08: Skip structuredData on error pages (explicit errorPage prop) // Don't infer error from noindex alone — main page can have noindex on 422 diff --git a/deploy/probe-admin-auth.py b/deploy/probe-admin-auth.py index 3913f0f..839433d 100644 --- a/deploy/probe-admin-auth.py +++ b/deploy/probe-admin-auth.py @@ -27,6 +27,10 @@ def probe(path, expected, authorization=None, method="GET", data=None): if path.startswith("/api/v1/admin/") and expected == 200: assert "no-store" in response.headers.get("Cache-Control", "") assert isinstance(json.load(response), dict) + if path == "/admin" or path.startswith("/admin/"): + if expected == 200: + assert "no-store" in response.headers.get("Cache-Control", "") + assert "noindex" in response.headers.get("X-Robots-Tag", "") probe("/admin", 401)