fix(cors): always send Cache-Control: no-store even without an Origin…

mfr/server/handlers/core.py

@@ -47,6 +47,12 @@ def _cross_origin_is_allowed(self):
         return False
 
     def set_default_headers(self):
+        # Always disable caching, even when no ``Origin`` header is present (e.g. a plain
+        # ``<iframe src="...">`` navigation). Without this, responses carry no caching
+        # directive at all in that case, leaving any intermediary (CDN, proxy, browser) free
+        # to apply its own heuristic caching to a render response.
+        self.set_header('Cache-control', 'no-store, no-cache, must-revalidate, max-age=0')
+
         if not self.request.headers.get('Origin'):
             return
 
@@ -70,7 +76,6 @@ def set_default_headers(self):
         self.set_header('Access-Control-Allow-Credentials', 'true')
         self.set_header('Access-Control-Allow-Headers', ', '.join(CORS_ACCEPT_HEADERS))
         self.set_header('Access-Control-Expose-Headers', ', '.join(CORS_EXPOSE_HEADERS))
-        self.set_header('Cache-control', 'no-store, no-cache, must-revalidate, max-age=0')
 
     def options(self):
         self.set_status(204)

tests/server/handlers/test_cors.py

@@ -166,3 +166,12 @@ def test_no_origin_means_no_cors(self):
             assert 'Access-Control-Allow-Credentials' not in self.handler.headers
             assert 'Access-Control-Allow-Headers' not in self.handler.headers
             assert 'Access-Control-Expose-Headers' not in self.handler.headers
+
+    @testing.gen_test
+    def test_no_origin_still_disables_caching(self):
+        for method in ('OPTIONS', 'HEAD' 'GET', 'POST', 'PUT', 'PATCH', 'DELETE'):
+            self.handler.request = MockRequest(
+                method=method,
+            )
+            self.handler.set_default_headers()
+            assert self.handler.headers['Cache-control'] == 'no-store, no-cache, must-revalidate, max-age=0'