SECURITY: Preload data only when rendering application layout

This commit drops the `before_action :preload_json` callback in `ApplicationController` as it adds unnecessary complexity to `ApplicationController` as well as other controllers which has to skip this callback. The source of the complexity comes mainly from the following two conditionals in the `preload_json` method:

```
    # We don't preload JSON on xhr or JSON request
    return if request.xhr? || request.format.json?

    # if we are posting in makes no sense to preload
    return if request.method != "GET"
```

Basically, the conditionals solely exists for optimization purposes to ensure that we don't run the preloading code when the request is not a GET request and the response is not expected to be HTML. The key problem here is that the conditionals are trying to expect what the content type of the response will be and this has proven to be hard to get right. Instead, we can simplify this problem by running the preloading code in a more deterministic way which is to preload only when the `application` layout is being rendered and this is main change that this commit introduces.
This commit is contained in:
Alan Guo Xiang Tan
2025-01-03 12:21:17 +08:00
committed by Roman Rizzi
parent 14d1d11536
commit 17e1bfe069
10 changed files with 201 additions and 192 deletions

View File

@ -16,15 +16,15 @@ class SiteController < ApplicationController
end
def custom_html
render json: custom_html_json
render json: @application_layout_preloader.custom_html_json
end
def banner
render json: banner_json
render json: @application_layout_preloader.banner_json
end
def emoji
render json: custom_emoji
render json: @application_layout_preloader.custom_emoji
end
def basic_info