Add Cache-Control no-transform to prevent Cloudflare from stripping Content-Length on HEAD requests

Author: elmiomar

src/main/java/gov/nist/oar/distrib/web/CacheSecurityConfig.java

@@ -69,17 +69,24 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
      */
     public SecurityFilterChain configureStrictSecurity(HttpSecurity http) throws Exception {
         http.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
-            .exceptionHandling(Customizer.withDefaults()) 
+            .exceptionHandling(Customizer.withDefaults())
             .addFilterBefore(authenticationFilter(), AnonymousAuthenticationFilter.class)
             .authorizeHttpRequests(auth -> {
                 // auth.requestMatchers("/ds/**").permitAll();
                 auth.requestMatchers("/**").permitAll();
-                auth.requestMatchers(SECURED_ENDPOINTS).authenticated(); 
+                auth.requestMatchers(SECURED_ENDPOINTS).authenticated();
             })
-            .csrf(csrf -> csrf.disable()) 
+            .headers(headers -> headers
+                .cacheControl(cache -> cache.disable())
+                .addHeaderWriter((request, response) -> {
+                    response.setHeader("Cache-Control",
+                        "no-store, no-cache, no-transform, must-revalidate, proxy-revalidate, max-age=0");
+                })
+            )
+            .csrf(csrf -> csrf.disable())
             .formLogin(form -> form.disable())
-            .httpBasic(httpBasic -> httpBasic.disable()) 
-            .logout(logout -> logout.disable()); 
+            .httpBasic(httpBasic -> httpBasic.disable())
+            .logout(logout -> logout.disable());
 
         return http.build();
     }

src/test/java/gov/nist/oar/distrib/web/DatasetAccessControllerTest.java

@@ -13,6 +13,7 @@
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.when;
@@ -384,6 +385,11 @@ public void testDownloadFileInfo() {
 
         assertEquals(HttpStatus.OK, resp.getStatusCode());
         assertTrue(resp.getHeaders().getFirst("Content-Type").startsWith("application/json"));
+        assertNotNull(resp.getHeaders().getFirst("Content-Length"));
+        String cacheControl = resp.getHeaders().getFirst("Cache-Control");
+        assertNotNull(cacheControl);
+        assertTrue(cacheControl.contains("no-transform"),
+                   "Cache-Control must contain no-transform to prevent Cloudflare from stripping Content-Length");
         assertNull(resp.getBody());
     }