Dennis Gaidaanddgtlmoon b91082b38a Set Cache-Control: no-store on dynamic responses by default (#4319) ...

* Set Cache-Control: no-store on dynamic responses by default

Pages with per-session content (settings, CSRF-token-bearing forms,
watch data) had no Cache-Control header, so a misconfigured CDN or
reverse proxy sitting in front of the app could cache and replay them
across requests/sessions — most commonly surfacing as "CSRF tokens do
not match" after the edge served a stale cached page. Routes that
already set their own Cache-Control (static assets, screenshots,
favicons) are left untouched.

* Adding tests and moving function

---------

Co-authored-by: dgtlmoon <dgtlmoon@gmail.com>

2026-09-17 11:20:31 +02:00

..

apprise

UI full refactor / upgrade (#4183)

2026-07-16 15:08:29 +02:00

custom_browser_url

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

fetchers

Browser fetchers - Follow re-navigation, and one content-ready deadline (re-targets #4421 + #4422 at master) (#4426)

2026-09-12 17:08:28 +02:00

import

Import - Improved Wachete Excel XLS import support for "dynamic wachet" (sets correct state of using chrome browser or not) column (#1934)

2023-11-06 12:50:27 +01:00

itemprop_test_examples

Restock multiprice improvements (#2698)

2024-10-11 11:43:35 +02:00

llm

LLM - Per watch/group settings and UI tidyup (#4354)

2026-09-02 10:07:34 +02:00

plugins

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

proxy_list

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

proxy_socks5

UI - Fixing lots of actions that should be a POST style action which led to a 404

2026-09-04 12:38:20 +02:00

restock

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

smtp

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

unit

xPath filters - Stop LC_COLLATE deciding what contains() means (#4437) (#4438)

2026-09-14 20:33:35 +02:00

visualselector

UI - Fixing lots of actions that should be a POST style action which led to a 404

2026-09-04 12:38:20 +02:00

__init__.py

Installation via pip (#186)

2021-08-16 15:24:37 +02:00

conftest.py

Memory usage - small improvement by tidying up module imports (#4352)

2026-09-01 17:50:50 +02:00

test2.pdf

Testing - Improve PDF text change detection tests (#1992)

2023-11-20 15:18:46 +01:00

test_access_control.py

UI - Fixing lots of actions that should be a POST style action which led to a 404

2026-09-04 12:38:20 +02:00

test_add_replace_remove_filter.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_add_watch_ui_browser.py

UI - Fixing lots of actions that should be a POST style action which led to a 404

2026-09-04 12:38:20 +02:00

test_api_notification_urls_validation.py

API - Remove flask_expects_json validation, this is covered entirely by OpenAPI, update OpenAPI spec. (#3871)

2026-02-13 16:30:59 +01:00

test_api_notifications.py

Run all pytests in parallel (#3569)

2025-10-28 21:32:25 +01:00

test_api_openapi.py

API - Processors configuration is now part of the API (#3902)

2026-02-25 11:30:39 +01:00

test_api_search.py

Run all pytests in parallel (#3569)

2025-10-28 21:32:25 +01:00

test_api_security.py

API Security - Watch GET history snapshot - Should return text/plain mimetype so it cant be accidently executed in the browser (#4158)

2026-05-19 11:36:42 +02:00

test_api_tags.py

fix(api): accept an existing tag UUID in the watch tag field, and deprecate it (#4361)

2026-09-02 16:46:27 +02:00

test_api.py

API - DELETE for Watch history #4397 (#4403)

2026-09-09 15:46:00 +02:00

test_auth.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_automatic_follow_ldjson_price.py

UI - Fixing lots of actions that should be a POST style action which led to a 404 (#4370)

2026-09-04 10:56:23 +02:00

test_backend.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_backup.py

UI - Fixing lots of actions that should be a POST style action which led to a 404

2026-09-04 12:38:20 +02:00

test_basic_socketio.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_block_while_text_present.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_cache_control_headers.py

Set Cache-Control: no-store on dynamic responses by default (#4319)

2026-09-17 11:20:31 +02:00

test_clone.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_commit_persistence.py

UI - Fixing lots of actions that should be a POST style action which led to a 404 (#4370)

2026-09-04 10:56:23 +02:00

test_conditions.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_css_selector.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_datastore_isolation.py

Run all pytests in parallel (#3569)

2025-10-28 21:32:25 +01:00

test_diff_download_patch_xss.py

GHSA-23mp-8222-96fr - reflected XSS in /diff/<uuid>/download-patch via from_version - Using built-in plain text response instead. Reported-by: Mayssare Amakhtari (@cy3erm)

2026-08-24 16:24:22 +02:00

test_diff_header.py

UI - Keep history diff title and controls visible while scrolling (#4412)

2026-09-16 14:19:00 +02:00

test_download_patch.py

LLM / AI Change detection rules and Summaries

2026-04-24 15:21:09 +02:00

test_duplicate_date_header.py

fix(http): send a single Date header on werkzeug built-in server (#4372)

2026-09-17 07:16:00 +02:00

test_element_removal.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_encoding.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_errorhandling.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_extract_csv.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_extract_regex.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_filter_exist_changes.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_filter_failure_notification.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_group.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_history_consistency.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_html_to_text.py

Use #!/usr/bin/env to support virtualenv (#2518)

2024-07-25 14:39:01 +02:00

test_i18n.py

UI - Fixing lots of actions that should be a POST style action which led to a 404

2026-09-04 12:38:20 +02:00

test_ignore_regex_text.py

Realtime UI - Socketio tweaks and refactor (#3220)

2025-06-03 10:17:19 +02:00

test_ignore_text.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_ignore.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_ignorehyperlinks.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_ignorestatuscode.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_ignorewhitespace.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_import.py

fix: XLSX import error messages report wrong row number after failed rows + test (#4036)

2026-04-10 13:08:28 +02:00

test_jinja2.py

Memory usage - small improvement by tidying up module imports (#4352)

2026-09-01 17:50:50 +02:00

test_jsonpath_jq_selector.py

UTF-8/Lone Surrogate encoding test improvements related to #4273 (#4353)

2026-09-01 17:55:13 +02:00

test_language_selector_anonymous.py

UI - Fixing lots of actions that should be a POST style action which led to a 404

2026-09-04 12:38:20 +02:00

test_link_to_open.py

feature: Implemented optional override link (#4290)

2026-09-09 16:06:24 +02:00

test_live_preview.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_llm_all_changes_diff.py

LLM / AI Change detection rules and Summaries

2026-04-24 15:21:09 +02:00

test_llm_api_key_security.py

UI - Fixing lots of actions that should be a POST style action which led to a 404

2026-09-04 12:38:20 +02:00

test_llm_change_summary.py

LLM - Per watch/group settings and UI tidyup (#4354)

2026-09-02 10:07:34 +02:00

test_llm_group_overrides.py

LLM - Per watch/group settings and UI tidyup (#4354)

2026-09-02 10:07:34 +02:00

test_llm_preview.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_llm_token_budget.py

UI - LLM - Fix for settings (wtforms vs pydantic) (#4184)

2026-05-25 18:43:33 +02:00

test_lxml_concurrency.py

LIBXML Data integrity fix, libxml must be locked across threads for any XML parsing (#4325)

2026-08-24 19:21:07 +02:00

test_nonrenderable_pages.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_notification_errors.py

Refactor of queue systenm and improve tests, improves multiple workers (#3826)

2026-02-02 22:28:27 +01:00

test_notification_restock_token.py

fix: safe-empty restock default so restock notification tokens work for any watch (#4249)

2026-07-13 09:26:54 +02:00

test_notification.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_obfuscations.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_pdf.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_preview_endpoints.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_queue_handler.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_queue_ui.py

UI full refactor / upgrade (#4183)

2026-07-16 15:08:29 +02:00

test_request.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_restock_itemprop.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_rss_group.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_rss_reader_mode.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_rss_single_watch.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_rss_tag_token.py

UI - Fixing lots of actions that should be a POST style action which led to a 404

2026-09-04 12:38:20 +02:00

test_rss.py

RSS - RSS pubDate is wrong on any non-UTC container: local time is relabelled as UTC - #4309 (#4314)

2026-08-20 15:49:29 +02:00

test_scheduler_timezone_regressions.py

Scheduler+API Bug - if an invalid timezone was set (through edit of watch or API) it could have crashed the scheduler, Added timezone to the official API docs (#4350)

2026-09-01 17:00:03 +02:00

test_scheduler.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_search.py

UI - Search modal - keep the search scoped to the tag you were viewing (#4425)

2026-09-12 17:48:48 +02:00

test_security.py

UI - Fixing lots of actions that should be a POST style action which led to a 404

2026-09-04 12:38:20 +02:00

test_settings_notifications_page.py

UI full refactor / upgrade (#4183)

2026-07-16 15:08:29 +02:00

test_settings_tag_force_reprocess.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_share_watch.py

UI - Make the 'share watch' optional, reduces visual noise, not really used by non-power users (#4448)

2026-09-17 10:54:43 +02:00

test_source.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_tag_colour.py

GHSA-4j9m-cxq4-9c36 - Improved validation Stored CSS Injection via tag_colour Field (#4317)

2026-08-20 17:59:02 +02:00

test_tag_url_match.py

fix: watches auto-tagged by group url_match_pattern regex missing from group tab filter (#4267)

2026-07-22 08:44:22 +02:00

test_translation_overlay.py

Translations - support for translation overlays/local translations of existing strings (#4365)

2026-09-03 11:15:46 +02:00

test_trigger_regex_with_filter.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_trigger_regex.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_trigger.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_ui.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_unique_lines.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_watch_edited_flag.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_watch_fields_storage.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_watch_limit.py

Feature/Watch limit - Adding test (#4360)

2026-09-02 15:43:59 +02:00

test_watchlist_unviewed_state.py

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

test_xpath_default_namespace.py

Improving UTF-8 handling for xPath selectors (Stop the xpath filter from chewing up non-regulat-latin-text style content) (#3659)

2025-11-28 13:13:41 +01:00

test_xpath_selector_unit.py

…

test_xpath_selector.py

Memory usage - small improvement by tidying up module imports (#4352)

2026-09-01 17:50:50 +02:00

test.pdf

PDF File change detection - Initial PDF fetcher support with basic text extraction (#1244)

2022-12-19 17:51:41 +01:00

util.py

Browser fetchers - Follow re-navigation, and one content-ready deadline (re-targets #4421 + #4422 at master) (#4426)

2026-09-12 17:08:28 +02:00