awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 18:41:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

review fixes

Browse Source
This commit is contained in:
x
2025-04-30 02:07:07 -04:00
parent 9f487ad026
commit eedffffc38
5 changed files with 78 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/server/routes/v1/certificate-router.ts
+16 -3
View File
@@ -1,3 +1,4 @@
/* eslint-disable @typescript-eslint/no-floating-promises */
import { z } from "zod";
import { CertificatesSchema } from "@app/db/schemas";
@@ -83,7 +84,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
200: z.string().trim()
}
},
handler: async (req) => {
handler: async (req, reply) => {
const { ca, cert, certPrivateKey } = await server.services.certificate.getCertPrivateKey({
serialNumber: req.params.serialNumber,
actor: req.permission.type,
@@ -105,6 +106,12 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
}
});
// Prevent proxies from caching sensitive data (private key)
reply.header("Cache-Control", "no-store, no-cache, must-revalidate, proxy-revalidate");
reply.header("Pragma", "no-cache");
reply.header("Expires", "0");
reply.header("Surrogate-Control", "no-store");
return certPrivateKey;
}
});
@@ -128,12 +135,12 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
200: z.object({
certificate: z.string().trim().describe(CERTIFICATES.GET_CERT.certificate),
certificateChain: z.string().trim().describe(CERTIFICATES.GET_CERT.certificateChain),
privateKey: z.string().trim().describe(CERTIFICATES.GET_CERT.certificateChain),
privateKey: z.string().trim().describe(CERTIFICATES.GET_CERT.privateKey),
serialNumber: z.string().trim().describe(CERTIFICATES.GET_CERT.serialNumberRes)
})
}
},
handler: async (req) => {
handler: async (req, reply) => {
const { certificate, certificateChain, serialNumber, cert, ca, privateKey } =
await server.services.certificate.getCertBundle({
serialNumber: req.params.serialNumber,
@@ -156,6 +163,12 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
}
});
// Prevent proxies from caching sensitive data (private key)
reply.header("Cache-Control", "no-store, no-cache, must-revalidate, proxy-revalidate");
reply.header("Pragma", "no-cache");
reply.header("Expires", "0");
reply.header("Surrogate-Control", "no-store");
return {
certificate,
certificateChain,