discourse/config/initializers/099-anon-cache.rb

# frozen_string_literal: true

require "middleware/anonymous_cache"

enabled =
  if Rails.configuration.respond_to?(:enable_anon_caching)
    Rails.configuration.enable_anon_caching
  else
    Rails.env.production? || Rails.env.test?
  end

if !ENV["DISCOURSE_DISABLE_ANON_CACHE"] && enabled
  # in an ideal world this is position 0, but mobile detection uses ... session and request and params
  Rails.configuration.middleware.insert_after Middleware::CspScriptNonceInjector,
                                              Middleware::AnonymousCache
end
DEV: enable frozen string literal on all files This reduces chances of errors where consumers of strings mutate inputs and reduces memory usage of the app. Test suite passes now, but there may be some stuff left, so we will run a few sites on a branch prior to merging 2019-05-03 06:17:27 +08:00			`# frozen_string_literal: true`

DEV: avoid require_dependency for some libs This avoids require dependency on method_profiler and anon cache. It means that if there is any change to these files the reloader will not pick it up. Previously the reloader was picking up the anon cache twice causing it to double load on boot. This caused warnings. Long term my plan is to give up on require dependency and instead use: https://github.com/Shopify/autoload_reloader 2018-12-31 07:53:30 +08:00			`require "middleware/anonymous_cache"`
introduce rack:cache as a default, so users don't need to configure apache or nginx under rack cache we are able to serve 620reqs a second per thin (on my machine) before it 12 (on my machine) reorganised so mini profilers can be cleanly disabled from config file added caching for categories index move production.rb to production.sample.rb 2013-04-11 14:24:08 +08:00
remove rack cache, it has been causing trouble instead implement an aggressive anonymous cache that is stored in redis this cache is sitting in the front of the middleware stack enabled only in production TODO: expire it more intelligently when stuff is created 2013-10-16 13:39:18 +08:00			`enabled =`
			`if Rails.configuration.respond_to?(:enable_anon_caching)`
			`Rails.configuration.enable_anon_caching`
			`else`
SECURITY: Don't reuse CSP nonce between anonymous requests 2023-07-28 19:53:44 +08:00			`Rails.env.production? \|\| Rails.env.test?`
remove rack cache, it has been causing trouble instead implement an aggressive anonymous cache that is stored in redis this cache is sitting in the front of the middleware stack enabled only in production TODO: expire it more intelligently when stuff is created 2013-10-16 13:39:18 +08:00			`end`
redis rack cache was crazy, it was just storing stuff in redis FOREVER, added a PR to fix, forked to my repo, sourcing a sane version 2013-05-07 15:32:43 +08:00
add unicorn launcher to support live reloads add oobgc rudimentary support 2013-11-13 12:28:39 +08:00			`if !ENV["DISCOURSE_DISABLE_ANON_CACHE"] && enabled`
BUGFIX: mobile ui was being cached for anon views 2014-01-09 11:08:42 +08:00			`# in an ideal world this is position 0, but mobile detection uses ... session and request and params`
FEATURE: Add experimental option for strict-dynamic CSP (#25664) The strict-dynamic CSP directive is supported in all our target browsers, and makes for a much simpler configuration. Instead of allowlisting paths, we use a per-request nonce to authorize `<script>` tags, and then those scripts are allowed to load additional scripts (or add additional inline scripts) without restriction. This becomes especially useful when admins want to add external scripts like Google Tag Manager, or advertising scripts, which then go on to load a ton of other scripts. All script tags introduced via themes will automatically have the nonce attribute applied, so it should be zero-effort for theme developers. Plugins may need some changes if they are inserting their own script tags. This commit introduces a strict-dynamic-based CSP behind an experimental `content_security_policy_strict_dynamic` site setting. 2024-02-16 19:16:54 +08:00			`Rails.configuration.middleware.insert_after Middleware::CspScriptNonceInjector,`
SECURITY: Don't reuse CSP nonce between anonymous requests 2023-07-28 19:53:44 +08:00			`Middleware::AnonymousCache`
introduce rack:cache as a default, so users don't need to configure apache or nginx under rack cache we are able to serve 620reqs a second per thin (on my machine) before it 12 (on my machine) reorganised so mini profilers can be cleanly disabled from config file added caching for categories index move production.rb to production.sample.rb 2013-04-11 14:24:08 +08:00			`end`