From 62ac989809c01edac493beb5f73f93d81cba025d Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Mon, 22 Dec 2025 22:44:01 +0000
Subject: [PATCH] Prevent caching of sensitive and dynamic API data

Co-authored-by: mathieumoran1 <mathieumoran1@gmail.com>
---
 public/js/app_control.js | 7 ++++---
 routes/users.js          | 4 ++++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/public/js/app_control.js b/public/js/app_control.js
index 253f747..96d8781 100644
--- a/public/js/app_control.js
+++ b/public/js/app_control.js
@@ -763,7 +763,8 @@ window.onload = async function () {
       method: 'GET',
       headers: {
         'Authorization': `Bearer ${token}`,
-      }
+      },
+      cache: 'no-store',
     });
 
     const data = await res.json().catch(() => ([]));
@@ -1968,7 +1969,7 @@ window.onload = async function () {
 
   async function refreshYears() {
     try {
-      const yearsRes = await fetch('/api/movies/years');
+      const yearsRes = await fetch('/api/movies/years', { cache: 'no-store' });
       const years = yearsRes.ok ? await yearsRes.json() : [];
       const cleanedYears = (Array.isArray(years) ? years : [])
         .map((y) => Number(y))
@@ -2245,7 +2246,7 @@ window.onload = async function () {
     adminMoviesBody.innerHTML = `<tr><td colspan="7" class="text-muted">Chargement…</td></tr>`;
 
     try {
-      const res = await fetch(url, { method: 'GET' });
+      const res = await fetch(url, { method: 'GET', cache: 'no-store' });
       if (!res.ok) {
         adminMoviesBody.innerHTML = `<tr><td colspan="7" class="text-danger">Erreur lors du chargement (${res.status})</td></tr>`;
         return;
diff --git a/routes/users.js b/routes/users.js
index 9197593..0c3aa29 100644
--- a/routes/users.js
+++ b/routes/users.js
@@ -394,6 +394,10 @@ router.get("/admin/list", verifyToken, async (req, res) => {
   }
 
   try {
+    // Admin + auth-scoped data: never allow caching.
+    res.set("Cache-Control", "private, no-store, must-revalidate");
+    res.set("Vary", "Authorization");
+
     const users = await User.find()
       .select("name email role mustChangePassword")
       .sort({ name: 1, email: 1 });