- commit
- f9a897323a3d3d93c6baabcc943b75061d71cb41
- parent
- 69fccd5ee316bf0d6514840e139706aa74f3af63
- author
- Dami <dami.etoile@gmail.com>
| M | worker/ | 13 | +++++++++---- |
@@ -116,8 +116,12 @@ export async function serve(req: Request, env: Env, url: URL): Promise<Response>
116116 if (!entry) return htmlResponse(NOT_FOUND_PAGE, 404);117117 118118 const etag = `"${entry.h}"`;119- if (req.headers.get("if-none-match") === etag) {120- return new Response(null, { status: 304, headers: { etag } });119+ const protectedSite = site.password_hash !== null;120+ const cacheControl = protectedSite ? "private, no-store" : "public, max-age=60";121+ // Never validate a previously cached protected response with 304: doing so122+ // would let the browser reuse its stored body after the site was locked.123+ if (!protectedSite && req.headers.get("if-none-match") === etag) {124+ return new Response(null, { status: 304, headers: { etag, "cache-control": cacheControl } });121125 }122126 123127 const blob = await env.CONTENT.get(`blob/${entry.h}`);@@ -128,8 +132,9 @@ export async function serve(req: Request, env: Env, url: URL): Promise<Response>
128132 "content-type": entry.ct,129133 "content-length": String(entry.s),130134 etag,131- // Short max-age: addresses are mutable on re-push. ETag makes revalidation free.132- "cache-control": "public, max-age=60",135+ // Public addresses are mutable on re-push. Protected content must never136+ // survive the password check in a browser or intermediary cache.137+ "cache-control": cacheControl,133138 },134139 });135140 }