mirror of
https://github.com/discourse/discourse.git
synced 2026-08-05 23:04:22 +08:00
f5cd83cab6Previously, enabling `cache_control_bfcache_compatibility` (the experiment currently running on meta, #38763) made HTML documents storable in the browser HTTP cache, and browsers skip revalidation on history navigations — so back/forward, session restore, and discarded-tab reloads could resurrect a days-old document: stale topic lists that only get older, and logged-in UI shown to logged-out sessions (and vice versa). Reported in https://meta.discourse.org/t/400459. This change keeps the documents out of shared caches (`no-cache, private`), reloads any document that was served from the HTTP cache on a history navigation (navigation entry with `type === "back_forward"` and `transferSize === 0` — a forced reload gets type `"reload"`, so it cannot loop), and validates the session on `pageshow` restores from the back/forward cache, reloading when the logged-in user no longer matches the one the page booted with. Both client-side checks only run when the setting is enabled; the full rationale (browser-engine specifics, why `transferSize` rather than `deliveryType`, why `fetch` rather than `ajax`) is in the commit message. Reproduced and verified end-to-end in Chromium and Firefox: with the setting enabled, `goBack()` served `/latest` with zero network contact — stale list, wrong login state, and the exact `403 /u/:username/private-message-topic-tracking-state` errors from the meta report; with this change the same navigation heals with a single automatic reload, and a control run with the setting disabled behaves as before. |
||
|---|---|---|
| .. | ||
| _head.html.erb | ||
| _noscript_footer.html.erb | ||
| _noscript_header.html.erb | ||
| _plugin_js.html.erb | ||
| application.html.erb | ||
| crawler.html.erb | ||
| email_template.html.erb | ||
| embed.html.erb | ||
| finish_installation.html.erb | ||
| no_ember.html.erb | ||
| publish.html.erb | ||
