satispress
satispress copied to clipboard
Cache-control headers
Had an issue where a host was caching the packages.json
endpoint after Composer was able to successfully connect. Subsequent unauthenticated requests, even in-browser, would succeed.
Looking at the response headers, I see that if an unauthorized hit is made, a Cache-Control: no-cache
header is returned, presumably because this is a default WP page and WP handles it.
But successful requests to the packages.json
endpoint do not return a Cache-Control: no-cache
header, and it seems like they should, since this endpoint requires authentication. Should all requests to SatisPress return no-cache headers to signal to services that are eagerly caching endpoints (especially those that present as static content, i.e. a JSON file) not to cache these endpoints?
Thoughts on this? I could look into a PR if someone can verify I'm not crazy.