From dfc286b3fc52fd4a89cb7f0d54a9861b85782156 Mon Sep 17 00:00:00 2001
From: Jordan Brown <Cyberboss@users.noreply.github.com>
Date: Sun, 25 Sep 2022 01:59:33 -0400
Subject: [PATCH] Set Cache-Control: no-cache for API responses

---
 build/Version.props                             |  2 +-
 src/Tgstation.Server.Host/Core/Application.cs   |  3 +++
 .../Extensions/ApplicationBuilderExtensions.cs  | 17 +++++++++++++++++
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/build/Version.props b/build/Version.props
index 73b755b5a6..8de33d0497 100644
--- a/build/Version.props
+++ b/build/Version.props
@@ -3,7 +3,7 @@
   <!-- Integration tests will ensure they match across the board -->
   <Import Project="ControlPanelVersion.props" />
   <PropertyGroup>
-    <TgsCoreVersion>5.0.1</TgsCoreVersion>
+    <TgsCoreVersion>5.0.2</TgsCoreVersion>
     <TgsConfigVersion>4.2.0</TgsConfigVersion>
     <TgsApiVersion>9.6.0</TgsApiVersion>
     <TgsApiLibraryVersion>9.6.1</TgsApiLibraryVersion>
diff --git a/src/Tgstation.Server.Host/Core/Application.cs b/src/Tgstation.Server.Host/Core/Application.cs
index ef0d0c1b9d..5e0ad1f486 100644
--- a/src/Tgstation.Server.Host/Core/Application.cs
+++ b/src/Tgstation.Server.Host/Core/Application.cs
@@ -467,6 +467,9 @@ namespace Tgstation.Server.Host.Core
 			else
 				logger.LogTrace("Web control panel disabled!");
 
+			// Do not cache a single thing beyond this point, it's all API
+			applicationBuilder.UseDisabledClientCache();
+
 			// authenticate JWT tokens using our security pipeline if present, returns 401 if bad
 			applicationBuilder.UseAuthentication();
 
diff --git a/src/Tgstation.Server.Host/Extensions/ApplicationBuilderExtensions.cs b/src/Tgstation.Server.Host/Extensions/ApplicationBuilderExtensions.cs
index 2f94b63fbc..ca1369dc46 100644
--- a/src/Tgstation.Server.Host/Extensions/ApplicationBuilderExtensions.cs
+++ b/src/Tgstation.Server.Host/Extensions/ApplicationBuilderExtensions.cs
@@ -8,6 +8,8 @@ using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Primitives;
+using Microsoft.Net.Http.Headers;
 
 using Tgstation.Server.Api.Models;
 using Tgstation.Server.Api.Models.Response;
@@ -56,6 +58,21 @@ namespace Tgstation.Server.Host.Extensions
 			});
 		}
 
+		/// <summary>
+		/// Suppress any client side caching of API calls.
+		/// </summary>
+		/// <param name="applicationBuilder">The <see cref="IApplicationBuilder"/> to configure.</param>
+		public static void UseDisabledClientCache(this IApplicationBuilder applicationBuilder)
+		{
+			if (applicationBuilder == null)
+				throw new ArgumentNullException(nameof(applicationBuilder));
+			applicationBuilder.Use(async (context, next) =>
+			{
+				context.Response.Headers.Add(HeaderNames.CacheControl, new StringValues("no-cache"));
+				await next();
+			});
+		}
+
 		/// <summary>
 		/// Suppress <see cref="global::System.Threading.Tasks.TaskCanceledException"/> warnings when a user aborts a request.
 		/// </summary>