2 files changed, 40 insertions, 7 deletions
diff --git a/spec/controllers/application_controller_spec.rb b/spec/controllers/application_controller_spec.rb
index be3fc832008..4e91068ab88 100644
--- a/spec/controllers/application_controller_spec.rb
+++ b/spec/controllers/application_controller_spec.rb
@@ -792,4 +792,30 @@ describe ApplicationController do
       end
     end
   end
+
+  context 'control headers' do
+    controller(described_class) do
+      def index
+        render json: :ok
+      end
+    end
+
+    context 'user not logged in' do
+      it 'sets the default headers' do
+        get :index
+
+        expect(response.headers['Cache-Control']).to be_nil
+      end
+    end
+
+    context 'user logged in' do
+      it 'sets the default headers' do
+        sign_in(user)
+
+        get :index
+
+        expect(response.headers['Cache-Control']).to eq 'max-age=0, private, must-revalidate, no-store'
+      end
+    end
+  end
 end
diff --git a/spec/controllers/uploads_controller_spec.rb b/spec/controllers/uploads_controller_spec.rb
index bcf289f36a9..f7af482b508 100644
--- a/spec/controllers/uploads_controller_spec.rb
+++ b/spec/controllers/uploads_controller_spec.rb
@@ -5,6 +5,13 @@ shared_examples 'content not cached without revalidation' do
   end
 end
 
+shared_examples 'content not cached without revalidation and no-store' do
+  it 'ensures content will not be cached without revalidation' do
+    # Fixed in newer versions of ActivePack, it will only output a single `private`.
+    expect(subject['Cache-Control']).to eq('max-age=0, private, must-revalidate, private, no-store')
+  end
+end
+
 describe UploadsController do
   let!(:user) { create(:user, avatar: fixture_file_upload("spec/fixtures/dk.png", "image/png")) }
 
@@ -177,7 +184,7 @@ describe UploadsController do
             expect(response).to have_gitlab_http_status(200)
           end
 
-          it_behaves_like 'content not cached without revalidation' do
+          it_behaves_like 'content not cached without revalidation and no-store' do
             subject do
               get :show, model: 'user', mounted_as: 'avatar', id: user.id, filename: 'dk.png'
 
@@ -239,7 +246,7 @@ describe UploadsController do
             expect(response).to have_gitlab_http_status(200)
           end
 
-          it_behaves_like 'content not cached without revalidation' do
+          it_behaves_like 'content not cached without revalidation and no-store' do
             subject do
               get :show, model: 'project', mounted_as: 'avatar', id: project.id, filename: 'dk.png'
 
@@ -292,7 +299,7 @@ describe UploadsController do
                 expect(response).to have_gitlab_http_status(200)
               end
 
-              it_behaves_like 'content not cached without revalidation' do
+              it_behaves_like 'content not cached without revalidation and no-store' do
                 subject do
                   get :show, model: 'project', mounted_as: 'avatar', id: project.id, filename: 'dk.png'
 
@@ -344,7 +351,7 @@ describe UploadsController do
             expect(response).to have_gitlab_http_status(200)
           end
 
-          it_behaves_like 'content not cached without revalidation' do
+          it_behaves_like 'content not cached without revalidation and no-store' do
             subject do
               get :show, model: 'group', mounted_as: 'avatar', id: group.id, filename: 'dk.png'
 
@@ -388,7 +395,7 @@ describe UploadsController do
                 expect(response).to have_gitlab_http_status(200)
               end
 
-              it_behaves_like 'content not cached without revalidation' do
+              it_behaves_like 'content not cached without revalidation and no-store' do
                 subject do
                   get :show, model: 'group', mounted_as: 'avatar', id: group.id, filename: 'dk.png'
 
@@ -445,7 +452,7 @@ describe UploadsController do
             expect(response).to have_gitlab_http_status(200)
           end
 
-          it_behaves_like 'content not cached without revalidation' do
+          it_behaves_like 'content not cached without revalidation and no-store' do
             subject do
               get :show, model: 'note', mounted_as: 'attachment', id: note.id, filename: 'dk.png'
 
@@ -498,7 +505,7 @@ describe UploadsController do
                 expect(response).to have_gitlab_http_status(200)
               end
 
-              it_behaves_like 'content not cached without revalidation' do
+              it_behaves_like 'content not cached without revalidation and no-store' do
                 subject do
                   get :show, model: 'note', mounted_as: 'attachment', id: note.id, filename: 'dk.png'