🐛 Bug Report: Cache-Control for /api/users/me/profile-picture.png is incorrect #208

New Issue

OVERLORD · 2026-02-04T18:00:40+03:00

OVERLORD commented

2026-02-04 18:00:40 +03:00

Originally created by @cdemi on GitHub (Mar 15, 2025).

Reproduction steps

I have noticed that /api/users/me/profile-picture.png has cache-control: max-age=14400

Since this URL is the same for all Pocket ID users, whoever logs in first after the cache is empty, gets his picture set for all users

Expected behavior

I think either the URL should have a unique identifier per user or else the Cache-Control configuration should be no-store

Actual Behavior

Users are seeing pictures of other users

Version and Environment

v0.40.0

Log Output

No response

Originally created by @cdemi on GitHub (Mar 15, 2025). ### Reproduction steps I have noticed that `/api/users/me/profile-picture.png` has `cache-control: max-age=14400` Since this URL is the same for all Pocket ID users, whoever logs in first after the cache is empty, gets his picture set for all users ### Expected behavior I think either the URL should have a unique identifier per user or else the Cache-Control configuration should be `no-store` ### Actual Behavior Users are seeing pictures of other users ### Version and Environment v0.40.0 ### Log Output _No response_

OVERLORD added the bug label 2026-02-04 18:00:40 +03:00

OVERLORD closed this issue

2026-02-04 18:00:51 +03:00

OVERLORD commented

2026-02-04 18:01:01 +03:00

@kmendell commented on GitHub (Mar 15, 2025):

You can get the profile picture per user by using a similar url to the below one:

/api/users<user-uuid-here>/profile-picture.png

@kmendell commented on GitHub (Mar 15, 2025): You can get the profile picture per user by using a similar url to the below one: `/api/users<user-uuid-here>/profile-picture.png`

OVERLORD commented

2026-02-04 18:01:10 +03:00

@cdemi commented on GitHub (Mar 15, 2025):

I understand that, but in the login screen and in the user account manager at the top right is a profile picture with that URL. I should have made my report clearer.

An alternative would be to change the URL of the top right profile picture to the one with the user's UUID

@cdemi commented on GitHub (Mar 15, 2025): I understand that, but in the login screen and in the user account manager at the top right is a profile picture with that URL. I should have made my report clearer. An alternative would be to change the URL of the top right profile picture to the one with the user's UUID

OVERLORD commented

2026-02-04 18:01:19 +03:00

@kmendell commented on GitHub (Mar 15, 2025):

Ahh okay i think i understand now, I will see what i can find/fix for this, but it may not be till tomorrow or early next week.

@kmendell commented on GitHub (Mar 15, 2025): Ahh okay i think i understand now, I will see what i can find/fix for this, but it may not be till tomorrow or early next week.

OVERLORD commented

2026-02-04 18:01:26 +03:00

@stonith404 commented on GitHub (Mar 16, 2025):

Fixed in v0.40.1.

@stonith404 commented on GitHub (Mar 16, 2025): Fixed in `v0.40.1`.

OVERLORD commented

2026-02-04 18:01:38 +03:00

@cdemi commented on GitHub (Mar 17, 2025):

Thanks for this! I'm not sure if it's working correctly. The top right profile image still links to /api/users/me/profile-picture.png but now it returns 500: {"error":"Something went wrong"}.

In the logs I see:

pocketid  | [GIN] 2025/03/17 - 07:32:21 | 500 |      61.449µs |    GET      "/api/users/me/profile-picture.png"
pocketid  | Error #01: Invalid UUID

I think the path to the top right picture needs to be changed to the one with the user's UUID.

I have opened #353 to fix the issue

@cdemi commented on GitHub (Mar 17, 2025): Thanks for this! I'm not sure if it's working correctly. The top right profile image still links to `/api/users/me/profile-picture.png` but now it returns 500: `{"error":"Something went wrong"}`. In the logs I see: ``` pocketid | [GIN] 2025/03/17 - 07:32:21 | 500 | 61.449µs | GET "/api/users/me/profile-picture.png" pocketid | Error #01: Invalid UUID ``` I think the path to the top right picture needs to be changed to the one with the user's UUID. I have opened #353 to fix the issue

OVERLORD referenced this issue

2026-02-04 18:51:45 +03:00

🐛 Bug Report: Docker image for version v1.2.0 fails to start #324

Sign in to join this conversation.