From 6ead07550059c14306f2c74c564b23793f033bb8 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Fri, 14 Aug 2026 13:06:45 -1000
Subject: Drop the Last-Modified, Expires and ETag headers

---
 source/cgit.c        | 11 -----------
 source/cgit.h        |  3 ---
 source/ui-plain.c    |  2 --
 source/ui-shared.c   | 19 -------------------
 source/ui-snapshot.c |  2 --
 5 files changed, 37 deletions(-)

(limited to 'source')

diff --git a/source/cgit.c b/source/cgit.c
index 53a33ca..ac8922b 100644
--- a/source/cgit.c
+++ b/source/cgit.c
@@ -46,10 +46,6 @@
 // a snapshots mask can carry.
 #define ALL_SNAPSHOT_FORMATS 0xFF
 
-// An Expires header has no way of saying never, so a page whose ttl is
-// negative claims ten years.
-#define NEVER_EXPIRES_SECONDS (10 * 365 * 24 * 60 * 60)
-
 /*
  * The first branch found is the fallback, so a repository whose default branch
  * does not exist still has something to show.
@@ -165,9 +161,6 @@ static void prepare_context(void)
 	ctx.page.charset = PAGE_ENCODING;
 	ctx.page.filename = NULL;
 	ctx.page.size = 0;
-	ctx.page.modified = time(NULL);
-	ctx.page.expires = ctx.page.modified;
-	ctx.page.etag = NULL;
 	string_list_init_dup(&ctx.cfg.mimetypes);
 	if (ctx.env.script_name)
 		ctx.cfg.script_name = xstrdup(ctx.env.script_name);
@@ -1218,10 +1211,6 @@ int cmd_main(int argc, const char **argv)
 	authenticate_cookie();
 
 	ttl = calc_ttl();
-	if (ttl < 0)
-		ctx.page.expires += NEVER_EXPIRES_SECONDS;
-	else
-		ctx.page.expires += ttl * 60;
 	// An unauthenticated request gets a body meant for one visitor, and a
 	// HEAD request stops after the headers.
 	if (!ctx.env.authenticated ||
diff --git a/source/cgit.h b/source/cgit.h
index ed966ae..d4b19f5 100644
--- a/source/cgit.h
+++ b/source/cgit.h
@@ -268,13 +268,10 @@ struct cgit_config {
 };
 
 struct cgit_page {
-	time_t modified;
-	time_t expires;
 	size_t size;
 	const char *mimetype;
 	const char *charset;
 	const char *filename;
-	const char *etag;
 	const char *title;
 	int status;
 	const char *statusmsg;
diff --git a/source/ui-plain.c b/source/ui-plain.c
index ed1ab31..5ba650b 100644
--- a/source/ui-plain.c
+++ b/source/ui-plain.c
@@ -100,7 +100,6 @@ static int print_object(const struct object_id *oid, const char *path)
 	}
 	ctx.page.filename = path;
 	ctx.page.size = size;
-	ctx.page.etag = oid_to_hex(oid);
 	cgit_print_http_headers();
 	html_raw(buf, size);
 	free(mimetype);
@@ -125,7 +124,6 @@ static void print_dir(const struct object_id *oid, const char *base,
 
 	fullpath = build_path(base, baselen, path);
 	leading_slash = (fullpath[0] == '/' ? "" : "/");
-	ctx.page.etag = oid_to_hex(oid);
 	cgit_print_http_headers();
 	// The listing is a full document of its own, so it carries the same
 	// doctype and charset as the layout pages or the browser would parse
diff --git a/source/ui-shared.c b/source/ui-shared.c
index 12df3b2..74c1c48 100644
--- a/source/ui-shared.c
+++ b/source/ui-shared.c
@@ -315,20 +315,6 @@ static void print_rel_date(time_t t, int tz, double count, const char *class,
 	htmlf("'>%.0f %s</time>", count, suffix);
 }
 
-static char *http_date(time_t t)
-{
-	static char day[][4] =
-		{"Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"};
-	static char month[][4] =
-		{"Jan", "Feb", "Mar", "Apr", "May", "Jun",
-		 "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"};
-	struct tm tm;
-	gmtime_r(&t, &tm);
-	return cgit_fmt("%s, %02d %s %04d %02d:%02d:%02d GMT", day[tm.tm_wday],
-		   tm.tm_mday, month[tm.tm_mon], 1900 + tm.tm_year,
-		   tm.tm_hour, tm.tm_min, tm.tm_sec);
-}
-
 static void print_rel_vcs_link(const char *url)
 {
 	html("<link rel='vcs-git' href='");
@@ -1119,10 +1105,6 @@ void cgit_print_http_headers(void)
 	}
 	if (!ctx.env.authenticated)
 		html("Cache-Control: no-cache, no-store\n");
-	htmlf("Last-Modified: %s\n", http_date(ctx.page.modified));
-	htmlf("Expires: %s\n", http_date(ctx.page.expires));
-	if (ctx.page.etag)
-		htmlf("ETag: \"%s\"\n", ctx.page.etag);
 	html("\n");
 	// Some pages follow the headers with output written by git itself, not
 	// through html_raw, so the buffer is emptied to keep the headers first.
@@ -1244,7 +1226,6 @@ void cgit_print_error_page(int code, const char *msg, const char *fmt, ...)
 void cgit_vprint_error_page(int code, const char *msg, const char *fmt,
 			    va_list ap)
 {
-	ctx.page.expires = ctx.cfg.cache_dynamic_ttl;
 	ctx.page.status = code;
 	ctx.page.statusmsg = msg;
 	cgit_print_layout_start();
diff --git a/source/ui-snapshot.c b/source/ui-snapshot.c
index 0bab8ea..3a14e16 100644
--- a/source/ui-snapshot.c
+++ b/source/ui-snapshot.c
@@ -206,7 +206,6 @@ static int send_snapshot(const struct cgit_snapshot_format *format,
 				"Not a commit reference: %s", hex);
 		return 1;
 	}
-	ctx.page.etag = oid_to_hex(&oid);
 	ctx.page.mimetype = xstrdup(format->mimetype);
 	ctx.page.filename = xstrdup(filename);
 	cgit_print_http_headers();
@@ -241,7 +240,6 @@ static int send_sig(const struct cgit_snapshot_format *format,
 	// act on.
 	html("X-Content-Type-Options: nosniff\n");
 	html("Content-Security-Policy: default-src 'none'\n");
-	ctx.page.etag = oid_to_hex(note);
 	ctx.page.mimetype = xstrdup("application/pgp-signature");
 	ctx.page.filename = xstrdup(sig_filename);
 	cgit_print_http_headers();
-- 
cgit v2.8.0