From 2f87fb6b456fd109c90a5093c31b7a3f62a32040 Mon Sep 17 00:00:00 2001
From: Lukas Reschke <lukas@statuscode.ch>
Date: Tue, 20 Jun 2017 19:46:10 +0200
Subject: [PATCH] Add Clear-Site-Data header
This adds a Clear-Site-Data header to the logout response which will delete all relevant data in the caches which may contain potentially sensitive content.
See https://w3c.github.io/webappsec-clear-site-data/#header for the definition of the types.
Ref https://twitter.com/mikewest/status/877149667909406723
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
---
core/Controller/LoginController.php | 4 +++-
tests/Core/Controller/LoginControllerTest.php | 2 ++
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/core/Controller/LoginController.php b/core/Controller/LoginController.php
index 93b695dd999..1c75b1f3c8b 100644
--- a/core/Controller/LoginController.php
+++ b/core/Controller/LoginController.php
@@ -107,7 +107,9 @@ class LoginController extends Controller {
}
$this->userSession->logout();
- return new RedirectResponse($this->urlGenerator->linkToRouteAbsolute('core.login.showLoginForm'));
+ $response = new RedirectResponse($this->urlGenerator->linkToRouteAbsolute('core.login.showLoginForm'));
+ $response->addHeader('Clear-Site-Data', '"cache", "cookies", "storage", "executionContexts"');
+ return $response;
}
/**
diff --git a/tests/Core/Controller/LoginControllerTest.php b/tests/Core/Controller/LoginControllerTest.php
index ca32a04efe1..bd2d0143caf 100644
--- a/tests/Core/Controller/LoginControllerTest.php
+++ b/tests/Core/Controller/LoginControllerTest.php
@@ -95,6 +95,7 @@ class LoginControllerTest extends TestCase {
->willReturn('/login');
$expected = new RedirectResponse('/login');
+ $expected->addHeader('Clear-Site-Data', '"cache", "cookies", "storage", "executionContexts"');
$this->assertEquals($expected, $this->loginController->logout());
}
@@ -124,6 +125,7 @@ class LoginControllerTest extends TestCase {
->willReturn('/login');
$expected = new RedirectResponse('/login');
+ $expected->addHeader('Clear-Site-Data', '"cache", "cookies", "storage", "executionContexts"');
$this->assertEquals($expected, $this->loginController->logout());
}
--
GitLab