Signed-in pages say Cache-Control: private, no-store issue #158 closed: completed andymccall opened this 22 days ago · 0 comments

Signed-in HTML pages (the dashboard and its sky, any page listing private repositories) sent no Cache-Control, relying on Cloudflare's default of not caching HTML; a cache-everything rule would serve one viewer's page to another. An HTML response to a request with a session cookie that sets no Cache-Control of its own now says private, no-store.