Drop the Last-Modified, Expires and ETag headers

1 file changed, 5 insertions, 1 deletion

diff --git a/custom/servers/apache.conf b/custom/servers/apache.conf
index 7ff3bab..4345a9e 100644
--- a/custom/servers/apache.conf
+++ b/custom/servers/apache.conf
@@ -135,7 +135,11 @@ AddType text/plain               .txt
     AllowOverride None
     Require all granted
 
-    # These assets rarely change, so let browsers cache them.
+    # These assets rarely change, so let browsers cache them. Keep the
+    # caching scoped to this directory. cgit sends no caching headers of its
+    # own, so a server-wide ExpiresDefault would stamp freshness onto its
+    # pages, fight the no-store cgit puts on the login page, and could let
+    # one visitor's page be served to another from a shared cache.
     <IfModule mod_expires.c>
         ExpiresActive On
         ExpiresDefault "access plus 30 days"