Stronger cache headers on admin surfaces, visible build version

Security

Pages behind a login could be kept by an intermediate cache. They are not anymore.

What changed

  • Every response on an authenticated route now carries Cache-Control: private, no-store and varies on the session cookie. This covers the store admin, the Katching dashboard, and the authenticated interfaces behind them.
  • The store admin shows the version and build of the image serving it, at the bottom of the What's new panel. One click copies the full reference.
  • All four stores were realigned onto the same image in the same move.

There is nothing for you to do. Immutable assets are still cached, so the admin loads exactly as fast as before.

Read this entry as markdown