immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 11 Packages Projects Releases 10 Wiki Activity

cache-control should be private #1027

New Issue
Closed
opened 2026-02-05 00:06:16 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2026-02-05 00:06:16 +03:00
Owner
Copy Link

Originally created by @uhthomas on GitHub (Jun 29, 2023).

The bug

It looks like files and thumbnails have the cache-control header set to max-age=31536000. As a plain GET request, this implicitly implies the resource can be stored in shared/public caches.

Normally, non-authenticated users are not able to view files or thumbnails. However if Immich were to be served by Cloudflare or some other reverse proxy then it's possible the private data could be cached and served to unauthenticated users.

The cache control header should have , private to prevent this.

The OS that Immich Server is running on

N/A

Version of Immich Server

v1.64.0

Version of Immich Mobile App

N/A

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

N/A

Your .env content

N/A

Reproduction steps

N/A

Additional information

No response

Originally created by @uhthomas on GitHub (Jun 29, 2023). ### The bug It looks like files and thumbnails have the `cache-control` header set to `max-age=31536000`. As a plain GET request, this implicitly implies the resource can be stored in shared/public caches. Normally, non-authenticated users are not able to view files or thumbnails. However if Immich were to be served by Cloudflare or some other reverse proxy then it's possible the private data could be cached and served to unauthenticated users. The cache control header should have `, private` to prevent this. ### The OS that Immich Server is running on N/A ### Version of Immich Server v1.64.0 ### Version of Immich Mobile App N/A ### Platform with the issue - [X] Server - [ ] Web - [ ] Mobile ### Your docker-compose.yml content ```YAML N/A ``` ### Your .env content ```Shell N/A ``` ### Reproduction steps ```bash N/A ``` ### Additional information _No response_
OVERLORD added the 🗄️server label 2026-02-05 00:06:16 +03:00
OVERLORD commented 2026-02-05 00:06:22 +03:00
Author
Owner
Copy Link

@uhthomas commented on GitHub (Jun 29, 2023):

These are the cache control headers Google Photos uses: private, max-age=86400, no-transform.

@uhthomas commented on GitHub (Jun 29, 2023): These are the cache control headers Google Photos uses: `private, max-age=86400, no-transform`.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label 🗄️server
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#1027
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?