From 89a3a7cd6b3979d6aa84a7d210bf288b45ee1504 Mon Sep 17 00:00:00 2001
From: Johannes Baumeister <jba@enwelo.de>
Date: Mon, 6 Jul 2026 13:06:08 +0200
Subject: [PATCH] Prevent browser caching of user projects list

---
 server.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server.js b/server.js
index cc4f104..e11b565 100644
--- a/server.js
+++ b/server.js
@@ -166,6 +166,11 @@ async function checkProjectAccess(req, requestedProjectIdentifier, client) {
 
 // API-Endpunkt zur Rückgabe der erlaubten Projekte des angemeldeten Nutzers
 app.get('/api/user/projekte', async (req, res) => {
+    // Verhindere Caching der Projektliste durch den Browser
+    res.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
+    res.set('Pragma', 'no-cache');
+    res.set('Expires', '0');
+
     const auth = getAllowedProjects(req);
     if (!auth) {
         log('Unauthorized request to /api/user/projekte (missing headers)');