0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-05 21:16:17 +08:00
discourse/app/views
Régis Hanol f5cd83cab6
FIX: Prevent browsers from restoring stale documents in bfcache mode (#42207)
Previously, enabling `cache_control_bfcache_compatibility` (the
experiment currently running on meta, #38763) made HTML documents
storable in the browser HTTP cache, and browsers skip revalidation on
history navigations — so back/forward, session restore, and
discarded-tab reloads could resurrect a days-old document: stale topic
lists that only get older, and logged-in UI shown to logged-out sessions
(and vice versa). Reported in https://meta.discourse.org/t/400459.

This change keeps the documents out of shared caches (`no-cache,
private`), reloads any document that was served from the HTTP cache on a
history navigation (navigation entry with `type === "back_forward"` and
`transferSize === 0` — a forced reload gets type `"reload"`, so it
cannot loop), and validates the session on `pageshow` restores from the
back/forward cache, reloading when the logged-in user no longer matches
the one the page booted with. Both client-side checks only run when the
setting is enabled; the full rationale (browser-engine specifics, why
`transferSize` rather than `deliveryType`, why `fetch` rather than
`ajax`) is in the commit message.

Reproduced and verified end-to-end in Chromium and Firefox: with the
setting enabled, `goBack()` served `/latest` with zero network contact —
stale list, wrong login state, and the exact `403
/u/:username/private-message-topic-tracking-state` errors from the meta
report; with this change the same navigation heals with a single
automatic reload, and a control run with the setting disabled behaves as
before.
2026-07-31 17:24:47 +02:00
..
about FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
admin/backups
application FIX: Respect forced color mode for logo on server-rendered pages (#37032) 2026-01-09 11:33:06 +01:00
badges
categories
common DEV: Drop empty core mobile/desktop stylesheets (#41988) 2026-07-23 20:30:13 +01:00
default DEV: Replace JS build system with Rolldown (#35963) 2026-05-29 11:11:55 +01:00
dev_mode DEV: Add /dev-mode endpoint for MiniProfiler auth cookie (#37027) 2026-01-12 10:01:20 +08:00
email UX: add preview to email templates (#36657) 2026-01-08 11:33:53 +04:00
embed DEV: Extract embed post date title into i18n-aware helper (#38594) 2026-03-17 09:12:21 -05:00
exceptions DEV: Replace JS build system with Rolldown (#35963) 2026-05-29 11:11:55 +01:00
finish_installation DEV: escape emails in finish installation (#37665) 2026-02-10 11:53:18 +01:00
groups
home_page DEV: Show login-required splash in root route (take 2) (#32629) 2025-05-14 11:25:43 -04:00
invites
layouts FIX: Prevent browsers from restoring stale documents in bfcache mode (#42207) 2026-07-31 17:24:47 +02:00
list FIX: Prevent double-escaping of HTML entities in titles and meta descriptions (#41261) 2026-07-02 20:26:35 +02:00
metadata
offline
posts
published_pages DEV: properly import color-scheme-stylesheets (#36325) 2025-11-28 13:57:22 -06:00
qunit DEV: Drop empty core mobile/desktop stylesheets (#41988) 2026-07-23 20:30:13 +01:00
robots_txt
safe_mode
search
session
sitemap
static FIX: improve the reliability of chat sounds (#41373) 2026-07-02 18:52:41 -04:00
tags
topics FIX: Prevent double-escaping of HTML entities in titles and meta descriptions (#41261) 2026-07-02 20:26:35 +02:00
user_notifications DEV: Strip unsubscribe links when sending digest previews to arbitrary addresses (#38298) 2026-03-05 13:58:51 -06:00
users FIX: Preserve URI delimiters in ICS URL properties, removing TEXT escaping (#42107) 2026-07-28 14:53:16 -05:00