Bugfix

internal/httpapi/httpapi.go

@@ -147,9 +147,14 @@ func New(c config.Config, a *auth.Service, ss *stacks.Service, n *nodes.Manager,
 	mux.Handle("/api/", a.Middleware(mutationOriginGuard(s.auditMiddleware(api))))
 	assets, _ := fs.Sub(web.FS, ".")
 	f := http.FileServer(http.FS(assets))
-	mux.Handle("GET /app.js", f)
-	mux.Handle("GET /styles.css", f)
-	mux.Handle("GET /{$}", f)
+	staticNoStore := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Pragma", "no-cache")
+		f.ServeHTTP(w, r)
+	})
+	mux.Handle("GET /app.js", staticNoStore)
+	mux.Handle("GET /styles.css", staticNoStore)
+	mux.Handle("GET /{$}", staticNoStore)
 	return securityHeaders(mux)
 }
 func (s *Server) agent(m *http.ServeMux) {

internal/httpapi/httpapi_test.go

@@ -1,6 +1,8 @@
 package httpapi
 
 import (
+	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"git.send.nrw/sendnrw/dockwatch/internal/audit"
@@ -16,3 +18,16 @@ func TestRouterPatternsDoNotConflict(t *testing.T) {
 	}()
 	_ = New(config.Config{Mode: config.ModeStandalone}, &auth.Service{}, nil, nil, nil, (*audit.Service)(nil), nil, nil, nil)
 }
+
+func TestStaticAssetsDisableBrowserCaching(t *testing.T) {
+	h := New(config.Config{Mode: config.ModeStandalone}, &auth.Service{}, nil, nil, nil, (*audit.Service)(nil), nil, nil, nil)
+	for _, path := range []string{"/", "/app.js", "/styles.css"} {
+		t.Run(strings.TrimPrefix(path, "/"), func(t *testing.T) {
+			rr := httptest.NewRecorder()
+			h.ServeHTTP(rr, httptest.NewRequest("GET", path, nil))
+			if got := rr.Header().Get("Cache-Control"); got != "no-store" {
+				t.Fatalf("Cache-Control for %s = %q, want no-store", path, got)
+			}
+		})
+	}
+}