From ca136d8e2e451291f518403b9105d99576f80f80 Mon Sep 17 00:00:00 2001
From: pqhuy1987 <pqhuy1987@gmail.com>
Date: Thu, 25 Jun 2026 11:33:57 +0700
Subject: [PATCH] =?UTF-8?q?[CLAUDE]=20FE-User=20=C2=B7=20FE-Admin:=20web.c?=
 =?UTF-8?q?onfig=20=E2=80=94=20index.html=20no-cache=20+=20assets=20immuta?=
 =?UTF-8?q?ble?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

S88 white-screen-incident hardening. An open tab could serve a stale index.html across
a deploy (IIS served index.html cacheable: only ETag/Last-Modified, no Cache-Control).
Add version-controlled web.config to fe-*/public (Vite -> dist -> deploy Copy-Item
overwrites the previously manually-managed server file):
- root staticContent clientCache=DisableCache -> Cache-Control: no-cache for the SPA
  shell (index.html served at / and via SPA-rewrite for /dashboard etc.) = always revalidate.
- <location path="assets"> UseMaxAge 365d + custom immutable -> hashed assets cached 1y.
Replicates the EXACT live rules (HTTP->HTTPS, SPA-Routes rewrite excl /api, .webmanifest
mime, 3 security headers) so routing is preserved. Applied + verified on live before commit
(index.html no-cache; asset immutable,max-age; / /dashboard /login 200; http->https 301).
api = .NET API (no SPA index.html) -> N/A.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 fe-admin/public/web.config | 48 ++++++++++++++++++++++++++++++++++++++
 fe-user/public/web.config  | 48 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 96 insertions(+)
 create mode 100644 fe-admin/public/web.config
 create mode 100644 fe-user/public/web.config

diff --git a/fe-admin/public/web.config b/fe-admin/public/web.config
new file mode 100644
index 0000000..ae00e09
--- /dev/null
+++ b/fe-admin/public/web.config
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+  <system.webServer>
+    <rewrite>
+      <rules>
+        <rule name="HTTP to HTTPS" stopProcessing="true">
+          <match url="(.*)" />
+          <conditions>
+            <add input="{HTTPS}" pattern="^OFF$" />
+          </conditions>
+          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
+        </rule>
+        <rule name="SPA Routes" stopProcessing="true">
+          <match url=".*" />
+          <conditions logicalGrouping="MatchAll">
+            <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
+            <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
+            <add input="{REQUEST_URI}" pattern="^/api" negate="true" />
+          </conditions>
+          <action type="Rewrite" url="/" />
+        </rule>
+      </rules>
+    </rewrite>
+    <staticContent>
+      <remove fileExtension=".webmanifest" />
+      <mimeMap fileExtension=".webmanifest" mimeType="application/manifest+json" />
+      <!-- [S88 hardening] SPA shell (index.html, served at / and via SPA-rewrite for /dashboard
+           etc.) + root static = no-cache so an open tab never serves a stale shell across a
+           deploy (the white-screen incident). Hashed /assets are overridden to immutable below. -->
+      <clientCache cacheControlMode="DisableCache" />
+    </staticContent>
+    <httpProtocol>
+      <customHeaders>
+        <add name="X-Content-Type-Options" value="nosniff" />
+        <add name="X-Frame-Options" value="DENY" />
+        <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
+      </customHeaders>
+    </httpProtocol>
+  </system.webServer>
+  <!-- [S88 hardening] Content-hashed build assets (index-<hash>.js/.css) are immutable -> cache 1y. -->
+  <location path="assets">
+    <system.webServer>
+      <staticContent>
+        <clientCache cacheControlMode="UseMaxAge" cacheControlMaxAge="365.00:00:00" cacheControlCustom="public, immutable" />
+      </staticContent>
+    </system.webServer>
+  </location>
+</configuration>
diff --git a/fe-user/public/web.config b/fe-user/public/web.config
new file mode 100644
index 0000000..ae00e09
--- /dev/null
+++ b/fe-user/public/web.config
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+  <system.webServer>
+    <rewrite>
+      <rules>
+        <rule name="HTTP to HTTPS" stopProcessing="true">
+          <match url="(.*)" />
+          <conditions>
+            <add input="{HTTPS}" pattern="^OFF$" />
+          </conditions>
+          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
+        </rule>
+        <rule name="SPA Routes" stopProcessing="true">
+          <match url=".*" />
+          <conditions logicalGrouping="MatchAll">
+            <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
+            <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
+            <add input="{REQUEST_URI}" pattern="^/api" negate="true" />
+          </conditions>
+          <action type="Rewrite" url="/" />
+        </rule>
+      </rules>
+    </rewrite>
+    <staticContent>
+      <remove fileExtension=".webmanifest" />
+      <mimeMap fileExtension=".webmanifest" mimeType="application/manifest+json" />
+      <!-- [S88 hardening] SPA shell (index.html, served at / and via SPA-rewrite for /dashboard
+           etc.) + root static = no-cache so an open tab never serves a stale shell across a
+           deploy (the white-screen incident). Hashed /assets are overridden to immutable below. -->
+      <clientCache cacheControlMode="DisableCache" />
+    </staticContent>
+    <httpProtocol>
+      <customHeaders>
+        <add name="X-Content-Type-Options" value="nosniff" />
+        <add name="X-Frame-Options" value="DENY" />
+        <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
+      </customHeaders>
+    </httpProtocol>
+  </system.webServer>
+  <!-- [S88 hardening] Content-hashed build assets (index-<hash>.js/.css) are immutable -> cache 1y. -->
+  <location path="assets">
+    <system.webServer>
+      <staticContent>
+        <clientCache cacheControlMode="UseMaxAge" cacheControlMaxAge="365.00:00:00" cacheControlCustom="public, immutable" />
+      </staticContent>
+    </system.webServer>
+  </location>
+</configuration>