第9章 — キャッシュセキュリティ: 見えない脅威

# 不要なヘッダーを無視
proxy_ignore_headers X-Forwarded-Host;
 
# Vary ヘッダーを適切に設定
add_header Vary "Accept-Encoding";
 
# キャッシュキーに含めるヘッダーを限定
proxy_cache_key "$scheme$request_method$host$uri$is_args$args";

# 静的ファイル以外はキャッシュしない
location ~* \.(css|js|png|jpg)$ {
    add_header Cache-Control "public, max-age=31536000";
}
 
location / {
    add_header Cache-Control "private, no-store";
}

class AuthenticatedController < ApplicationController
  before_action :set_no_store
 
  private
 
  def set_no_store
    response.headers["Cache-Control"] = "no-store"
    response.headers["Pragma"] = "no-cache"
  end
end
 
# 公開ページだけ上書き
class ArticlesController < ApplicationController
  def show
    @article = Article.published.find(params[:id])
    expires_in 10.minutes, public: true,
               "stale-while-revalidate": 60
  end
end

class ProductsController < ApplicationController
  def show
    @product = Product.find(params[:id])
    response.headers["Cache-Control"] = "public, max-age=60"
    response.headers["Surrogate-Control"] = "max-age=3600"
  end
end