From 2bbc2f79730d0ee103fcea7582fcf41baf559a45 Mon Sep 17 00:00:00 2001
From: Vlad0n20 <vlad.onischuk1234@gmail.com>
Date: Mon, 24 Aug 2026 16:05:21 +0200
Subject: [PATCH] fix(cors): always send Cache-Control: no-store even without
 an Origin header

---
 mfr/server/handlers/core.py        | 7 ++++++-
 tests/server/handlers/test_cors.py | 9 +++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/mfr/server/handlers/core.py b/mfr/server/handlers/core.py
index 3375f3e1..a8fc1324 100644
--- a/mfr/server/handlers/core.py
+++ b/mfr/server/handlers/core.py
@@ -47,6 +47,12 @@ def _cross_origin_is_allowed(self):
         return False
 
     def set_default_headers(self):
+        # Always disable caching, even when no ``Origin`` header is present (e.g. a plain
+        # ``<iframe src="...">`` navigation). Without this, responses carry no caching
+        # directive at all in that case, leaving any intermediary (CDN, proxy, browser) free
+        # to apply its own heuristic caching to a render response.
+        self.set_header('Cache-control', 'no-store, no-cache, must-revalidate, max-age=0')
+
         if not self.request.headers.get('Origin'):
             return
 
@@ -70,7 +76,6 @@ def set_default_headers(self):
         self.set_header('Access-Control-Allow-Credentials', 'true')
         self.set_header('Access-Control-Allow-Headers', ', '.join(CORS_ACCEPT_HEADERS))
         self.set_header('Access-Control-Expose-Headers', ', '.join(CORS_EXPOSE_HEADERS))
-        self.set_header('Cache-control', 'no-store, no-cache, must-revalidate, max-age=0')
 
     def options(self):
         self.set_status(204)
diff --git a/tests/server/handlers/test_cors.py b/tests/server/handlers/test_cors.py
index 5f2b245f..8f7974b5 100644
--- a/tests/server/handlers/test_cors.py
+++ b/tests/server/handlers/test_cors.py
@@ -166,3 +166,12 @@ def test_no_origin_means_no_cors(self):
             assert 'Access-Control-Allow-Credentials' not in self.handler.headers
             assert 'Access-Control-Allow-Headers' not in self.handler.headers
             assert 'Access-Control-Expose-Headers' not in self.handler.headers
+
+    @testing.gen_test
+    def test_no_origin_still_disables_caching(self):
+        for method in ('OPTIONS', 'HEAD' 'GET', 'POST', 'PUT', 'PATCH', 'DELETE'):
+            self.handler.request = MockRequest(
+                method=method,
+            )
+            self.handler.set_default_headers()
+            assert self.handler.headers['Cache-control'] == 'no-store, no-cache, must-revalidate, max-age=0'