docbrown/app/controllers/concerns/edge_cache_safety_check.rb
Ben Halpern badefcabeb
Developer experience/security: Make dev/test blow up if current_user is used erroneously (#11237)
* Let dev/test blow up if current_user is used erroneously

* Fix logic

* Fix click-to-edit permissions

* Change test to check for new behavior

* linting

* Edit tests

* Change test

* Clean up implementation

* Update comment

* Fix instance vars

* Update app/controllers/concerns/caching_headers.rb

* Merge origin and add request_store gem
2020-11-12 11:54:23 -05:00

16 lines
562 B
Ruby

module EdgeCacheSafetyCheck
extend ActiveSupport::Concern
CANNOT_USE_CURRENT_USER = "You may not use current_user in this cached code path.".freeze
def current_user
# In production, current_user will cause a cache leak if it's placed within an edge-cached code path.
# More information here:
# https://docs.forem.com/technical-overview/architecture/#we-cache-many-content-pages-on-the-edge
return super unless RequestStore.store[:edge_caching_in_place]
return if session_current_user_id.blank?
CANNOT_USE_CURRENT_USER
end
end