asim /spotted/queue Cache-Control: no-store, must-revalidate (admin token-gated, never share cache). 65/65.

4cd8acfbc109c564aa395692f621ce87bf08f797 · 2026-05-13 07:35:53 -0700 · SteveStudio2

Files touched

M server.js

Diff

commit 4cd8acfbc109c564aa395692f621ce87bf08f797
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Wed May 13 07:35:53 2026 -0700

    asim /spotted/queue Cache-Control: no-store, must-revalidate (admin token-gated, never share cache). 65/65.
---
 server.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/server.js b/server.js
index 4043c50..abd9271 100644
--- a/server.js
+++ b/server.js
@@ -807,6 +807,9 @@ app.get('/api/spotted/stats', async (_req, res) => {
 // the public gallery WITHOUT being deleted — undoable from psql.
 // ────────────────────────────────────────────────────────────────────
 app.get('/spotted/queue', async (req, res) => {
+  // Admin pages must never sit in any cache (shared or browser) — auth state
+  // is token-gated and stale snapshots could leak privileged data.
+  res.setHeader('Cache-Control', 'no-store, must-revalidate');
   if (!isAdmin(req)) return res.status(401).type('html').send(htmlShell('Admin', `<div class="empty"><p>Admin token required. Append <code>?token=&lt;ASIM_ADMIN_TOKEN&gt;</code> to the URL.</p></div>`));
   try {
     const [r, sres] = await Promise.all([

← e67d0fe asim /healthz Cache-Control: no-store (liveness should alway · back to AsSeenInMovies · asseeninmovies: GET /sitemap.txt — plain-text sitemap (Googl c819393 →