Set Cache-Control on every rendered page, and record the CSRF token's unbinding

src/http/app.ts

@@ -36,6 +36,10 @@ import { localPath } from "./safe-url.ts";
 import { routePublic, serveStatic } from "./static.ts";
 import { renderPluginView } from "../plugin-host/view-resolver.ts";
 
+// max-age=0 keeps a browser from showing a signed-out page after sign-in; only a shared cache keeps it.
+const NO_STORE = "private, no-store";
+const SHARED_PAGE = "public, max-age=0, s-maxage=60";
+
 const rootDir = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
 
 export interface AppOptions {
@@ -151,7 +155,10 @@ export function createApp(options: AppOptions = {}): Server {
       await sendResult(ctx.res, result, pluginViewsFor(pluginCtx, homePlugin.id), pluginCtx.localeHref);
       return null;
     }
-    return { data: { chrome: ctx.chrome, user: ctx.user }, view: "home" };
+    // Shared only when nothing in the page or its headers belongs to this visitor: no user, and no
+    // Set-Cookie (a fresh CSRF cookie is per-visitor).
+    const sharable = !ctx.user && !ctx.res.hasHeader("set-cookie");
+    return { data: { chrome: ctx.chrome, user: ctx.user }, ...(sharable ? { headers: { "cache-control": SHARED_PAGE } } : {}), view: "home" };
   };
 
   // "/dashboard", gated to a signed-in user. A plugin may own it via `dashboard`; else the built-in
@@ -203,6 +210,10 @@ export function createApp(options: AppOptions = {}): Server {
       // A cache in front of us must key on the language. Set after the static branch: an asset is
       // the same bytes in every language, and a Vary there fragments its entry per raw header.
       res.setHeader("vary", "accept-language");
+      // Fail closed: a cache in front of us must not keep a page that may carry a user's data. A
+      // response that is the same for everyone opts in through its own headers (serveHome below, or
+      // a plugin's RouteResult.headers).
+      res.setHeader("cache-control", NO_STORE);
 
       // Canonical host (APP_URL): send an off-host visitor to the configured origin so the browser,
       // the themed forms and the cross-origin Kratos POST share one cookie host — otherwise the