Fix: set cache private/no-store when auth enabled

src/middleware.js

@@ -6,6 +6,16 @@ import { isAuthEnabled } from "utils/env";
 const authEnabled = isAuthEnabled();
 const authSecret = process.env.NEXTAUTH_SECRET || process.env.HOMEPAGE_AUTH_SECRET;
 
+// Prerendered pages carry `s-maxage`, and the dashboard HTML embeds the service and
+// bookmark inventory. Without this, a CDN or caching reverse proxy in front of Homepage
+// would store an authenticated response and serve it to anonymous visitors.
+function withPrivateCache(res) {
+  if (authEnabled) {
+    res.headers.set("Cache-Control", "private, no-store");
+  }
+  return res;
+}
+
 export async function middleware(req) {
   // Check the Host header, if HOMEPAGE_ALLOWED_HOSTS is set
   const host = req.headers.get("host");
@@ -26,18 +36,18 @@ export async function middleware(req) {
   if (authEnabled && !pathname.startsWith("/api/healthcheck")) {
     // The MCP API handler authorizes both bearer tokens and Homepage sessions.
     if (pathname === "/api/mcp") {
-      return NextResponse.next();
+      return withPrivateCache(NextResponse.next());
     }
 
     const token = await getToken({ req, secret: authSecret });
     if (!token) {
       const signInUrl = new URL("/auth/signin", req.url);
       signInUrl.searchParams.set("callbackUrl", "/");
-      return NextResponse.redirect(signInUrl);
+      return withPrivateCache(NextResponse.redirect(signInUrl));
     }
   }
 
-  return NextResponse.next();
+  return withPrivateCache(NextResponse.next());
 }
 
 export const config = {