Fix: cache and CSRF

cmd/api/cache/ttl.go

@@ -67,22 +67,27 @@ func (c *TTLCache) Get(key string) ([]byte, bool) {
 
 func (c *TTLCache) Set(key string, data []byte) {
 	c.mx.Lock()
-	queueIdx := len(c.m)
-	item := &ttlItem{
-		data:      data,
-		expiredAt: time.Now().Add(c.expiration),
-	}
+	{
+		queueIdx := len(c.m)
+		item := &ttlItem{
+			data:      data,
+			expiredAt: time.Now().Add(c.expiration),
+		}
 
-	if _, ok := c.m[key]; ok {
-		c.m[key] = item
-	} else {
-		c.m[key] = item
-		if queueIdx == c.maxEntitiesCount {
-			keyForRemove := c.queue[queueIdx-1]
-			c.queue = append([]string{key}, c.queue[:queueIdx-1]...)
-			delete(c.m, keyForRemove)
+		if _, ok := c.m[key]; ok {
+			c.m[key] = item
 		} else {
-			c.queue[c.maxEntitiesCount-queueIdx-1] = key
+			c.m[key] = item
+			if queueIdx == c.maxEntitiesCount {
+				keyForRemove := c.queue[0]
+				for i := 0; i < len(c.queue)-1; i++ {
+					c.queue[i] = c.queue[i+1]
+				}
+				c.queue[queueIdx-1] = key
+				delete(c.m, keyForRemove)
+			} else {
+				c.queue[c.maxEntitiesCount-queueIdx-1] = key
+			}
 		}
 	}
 	c.mx.Unlock()

cmd/api/cache/ttl_test.go

@@ -106,16 +106,17 @@ func TestTTLCache_SetGet(t *testing.T) {
 		c.Set("test2", []byte{0})
 		c.Set("test", []byte{0})
 		c.Set("test3", []byte{0})
+		c.Set("test4", []byte{0})
 		c.m["test"].expiredAt = time.Now().Add(-time.Hour)
 
-		require.Len(t, c.m, 3)
+		require.Len(t, c.m, 4)
 		require.Len(t, c.queue, 4)
 
 		_, exists := c.Get("test")
 		require.False(t, exists)
 
 		require.Len(t, c.queue, 4)
-		require.Len(t, c.m, 2)
+		require.Len(t, c.m, 3)
 	})
 }
 

cmd/api/init.go

@@ -112,13 +112,10 @@ func metricsSkipper(c echo.Context) bool {
 }
 
 func postSkipper(c echo.Context) bool {
-	if c.Path() == "/v1/blob" {
+	if strings.HasPrefix(c.Path(), "/v1/blob") {
 		return true
 	}
-	if c.Path() == "/v1/blob/metadata" {
-		return true
-	}
-	if c.Path() == "/v1/auth/rollup" {
+	if strings.HasPrefix(c.Path(), "/v1/auth") {
 		return true
 	}
 	return false