From dfff016ea6321ad0f0e9d26b2d3363faccd566d6 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 25 Sep 2026 12:05:17 -1000 Subject: Mark a page behind an auth filter private Only the login page carried a Cache-Control, so a page an auth filter had let a visitor see could be kept by a cache shared with the next visitor. The page also varies on the cookie that got them in. --- source/ui-shared.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'source') diff --git a/source/ui-shared.c b/source/ui-shared.c index a112fb2..2c4db2c 100644 --- a/source/ui-shared.c +++ b/source/ui-shared.c @@ -1465,8 +1465,13 @@ void cgit_print_http_headers(void) html("X-Content-Type-Options: nosniff\n"); html("Content-Security-Policy: default-src 'none'\n"); } + // A page behind an auth filter is for the visitor who was let in, so a + // cache shared with other visitors must not keep it, and it varies on + // the cookie that got them in. if (!ctx.env.authenticated) html("Cache-Control: no-cache, no-store\n"); + else if (ctx.cfg.auth_filter) + html("Cache-Control: private\nVary: Cookie\n"); html("\n"); // Some pages follow the headers with output written by git itself, not // through html_raw, so the buffer is emptied to keep the headers first. -- cgit 2.12.1