Apache is removing ETag headers

[redshiftzero]

Description

We send ETags in responses from a couple of journalist API endpoints (reference), but Apache is stripping them off via Header unset Etag

Steps to Reproduce

0. Provision staging servers
1. Add a test source, a test submission, and a test journalist user
2. Authenticate to the API via submitting your credentials to /api/v1/token as described here
3. Try to download a response via a GET request to /api/v1/sources/<source_uuid>/submissions/<submission_uuid>/download where source_uuid and submission_uuid are valid

Expected Behavior

response has ETag header

Actual Behavior

response does not have ETag header

Comments

This is similar to #3772 so a similar fix will do here (modifying Apache configs in postinst of securedrop-app-code package). In terms of priority, this is not a showstopping bug (users can still download files via the API without issue), so 0.11.0 or a bugfix release after 0.10.0 is fine.

[redshiftzero]

When this bug is addressed, we can revert freedomofpress/securedrop-sdk@6170a33 in the SDK

[heartsucker]

From that ticket:

ETags are being stripped from staging/production servers due to an Apache misconfiguration.

I am rather sure this was intentional and was done as part of the no-cache headers to prevent anything from being left on a source's computer.

[heartsucker]

Though I guess it is a a misconfiguration in the sense that it shouldn't be in the journalist config. Anyway just woke up, ignore me.

[redshiftzero]

No you're right @heartsucker, we should only modify the journalist Apache config

[emkll]

Recapping discussion in gitter with @heartsucker @redshiftzero
To close this item ticket, we should simply remove Header unset Etag directive from the Journalist interface config, which should allow for the values that are set in the Application/API to be sent to the client and not stripped by Apache.
This configuration change should be sufficient to report download resumption as well (due to Range RequestHeader not being unset).

[redshiftzero]

This was closed by #4023