Prevent caching of sensitive and dynamic API data

Co-authored-by: mathieumoran1 <[email protected]>

public/js/app_control.js

@@ -763,7 +763,8 @@ window.onload = async function () {
       method: 'GET',
       headers: {
         'Authorization': `Bearer ${token}`,
-      }
+      },
+      cache: 'no-store',
     });
 
     const data = await res.json().catch(() => ([]));
@@ -1968,7 +1969,7 @@ window.onload = async function () {
 
   async function refreshYears() {
     try {
-      const yearsRes = await fetch('/api/movies/years');
+      const yearsRes = await fetch('/api/movies/years', { cache: 'no-store' });
       const years = yearsRes.ok ? await yearsRes.json() : [];
       const cleanedYears = (Array.isArray(years) ? years : [])
         .map((y) => Number(y))
@@ -2245,7 +2246,7 @@ window.onload = async function () {
     adminMoviesBody.innerHTML = `<tr><td colspan="7" class="text-muted">Chargement…</td></tr>`;
 
     try {
-      const res = await fetch(url, { method: 'GET' });
+      const res = await fetch(url, { method: 'GET', cache: 'no-store' });
       if (!res.ok) {
         adminMoviesBody.innerHTML = `<tr><td colspan="7" class="text-danger">Erreur lors du chargement (${res.status})</td></tr>`;
         return;

routes/users.js

@@ -394,6 +394,10 @@ router.get("/admin/list", verifyToken, async (req, res) => {
   }
 
   try {
+    // Admin + auth-scoped data: never allow caching.
+    res.set("Cache-Control", "private, no-store, must-revalidate");
+    res.set("Vary", "Authorization");
+
     const users = await User.find()
       .select("name email role mustChangePassword")
       .sort({ name: 1, email: 1 });