Panel assets: cache instead of no-cache (#322)

OP OpenVibers committed 6 days ago · 8a349b14ca · 1 file, +5 −1

* Home and panel assets: cache instead of no-cache

The home page answered "private, no-cache" for everyone, and the panel CSS/JS
at fixed URLs answered "no-cache", so every visit revalidated each of them.
Signed out the home is the same page for everybody: a minute of reuse and a
stale copy while the next one is fetched. A signed-in viewer keeps private,
no-store. The unversioned panel assets take the shared policy's five minutes
plus a day of stale-while-revalidate (they have no content hash, so they are
not immutable).

* Keep the home page private

test/home.test.js pins "private, no-cache" on GET / because the page's two
actions differ by sign-in and a shared cache that drops Vary (Cloudflare does)
could hand the signed-out page to a signed-in visitor. The asset caching is the
part that was plainly wrong; leave the page as it was.

Changes

ddiff --git a/server/web/routes.js b/server/web/routes.js
iindex f57959a..cacd47d 100644
---- a/server/web/routes.js
++++ b/server/web/routes.js
@@@ -36,6 +36,7 @@ const { validCallWord } = require('../voice');
  const path = require('path');
  const express = require('express');
  const seo = require('openvibe-shared/seo');
++const cache = require('openvibe-shared/cache-policy');
  const appIcon = require('openvibe-shared/app-icon');
  const { getProfile, listProfiles, loadProfiles } = require('../profiles');
  const { frameAncestors } = require('../config');
@@@ -210,7 +211,10 @@ function createWebRoutes(config, { domain = null, sim = null, onvif = null, limi
      });
      if (!domain) return r;
  
--    const asset = (file, type) => (req, res) => { res.setHeader('Cache-Control', 'no-cache'); res.type(type).sendFile(path.join(PUBLIC, file)); };
++    // These have no content hash in their URL, so they are not immutable: the shared policy gives a
++    // browser five minutes of reuse and a day of stale-while-revalidate instead of a revalidation
++    // round trip on every page view.
++    const asset = (file, type) => (req, res) => { res.setHeader('Cache-Control', cache.assetHeaders(req.path, { hashed: false })); res.type(type).sendFile(path.join(PUBLIC, file)); };
      r.get('/panel/panel.js', asset('panel.js', 'application/javascript'));
      r.get('/panel/panel.css', asset('panel.css', 'text/css'));
      r.get('/panel/screen-share.js', asset('screen-share.js', 'application/javascript'));

diff --git a/server/web/routes.js b/server/web/routes.js

index f57959a..cacd47d 100644

--- a/server/web/routes.js

+++ b/server/web/routes.js

@@ -36,6 +36,7 @@ const { validCallWord } = require('../voice');

const path = require('path');

const express = require('express');

const seo = require('openvibe-shared/seo');

+const cache = require('openvibe-shared/cache-policy');

const appIcon = require('openvibe-shared/app-icon');

const { getProfile, listProfiles, loadProfiles } = require('../profiles');

const { frameAncestors } = require('../config');

@@ -210,7 +211,10 @@ function createWebRoutes(config, { domain = null, sim = null, onvif = null, limi

});

if (!domain) return r;

- const asset = (file, type) => (req, res) => { res.setHeader('Cache-Control', 'no-cache'); res.type(type).sendFile(path.join(PUBLIC, file)); };

+ // These have no content hash in their URL, so they are not immutable: the shared policy gives a

+ // browser five minutes of reuse and a day of stale-while-revalidate instead of a revalidation

+ // round trip on every page view.

+ const asset = (file, type) => (req, res) => { res.setHeader('Cache-Control', cache.assetHeaders(req.path, { hashed: false })); res.type(type).sendFile(path.join(PUBLIC, file)); };

r.get('/panel/panel.js', asset('panel.js', 'application/javascript'));

r.get('/panel/panel.css', asset('panel.css', 'text/css'));

r.get('/panel/screen-share.js', asset('screen-share.js', 'application/javascript'));