mirror of
https://github.com/pocket-id/pocket-id.git
synced 2025-12-11 07:42:58 +03:00
🐛 Bug Report: Cache-Control for /api/users/me/profile-picture.png is incorrect
#294
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @cdemi on GitHub.
Reproduction steps
I have noticed that
/api/users/me/profile-picture.pnghascache-control: max-age=14400Since this URL is the same for all Pocket ID users, whoever logs in first after the cache is empty, gets his picture set for all users
Expected behavior
I think either the URL should have a unique identifier per user or else the Cache-Control configuration should be
no-storeActual Behavior
Users are seeing pictures of other users
Version and Environment
v0.40.0
Log Output
No response
@kmendell commented on GitHub:
Ahh okay i think i understand now, I will see what i can find/fix for this, but it may not be till tomorrow or early next week.
@cdemi commented on GitHub:
Thanks for this! I'm not sure if it's working correctly. The top right profile image still links to
/api/users/me/profile-picture.pngbut now it returns 500:{"error":"Something went wrong"}.In the logs I see:
I think the path to the top right picture needs to be changed to the one with the user's UUID.
I have opened #353 to fix the issue
@stonith404 commented on GitHub:
Fixed in
v0.40.1.@kmendell commented on GitHub:
You can get the profile picture per user by using a similar url to the below one:
/api/users<user-uuid-here>/profile-picture.png@cdemi commented on GitHub:
I understand that, but in the login screen and in the user account manager at the top right is a profile picture with that URL. I should have made my report clearer.
An alternative would be to change the URL of the top right profile picture to the one with the user's UUID