Moss · SSR cache headers

Signed-in request: `private, no-store`

A request whose session cookie resolves to a principal is drawn for that principal and served with Cache-Control: private, no-store, so no cache may store it. The token in this example is a dev token, which only a server booted with session: 'dev-open' trusts; a deployment verifies its own.

Cookie header

theme=dark; nisc.token=eyJzdWIiOiJncmFjZSJ9

Drawn for

'grace'

Response headers

cache-control: private, no-store
vary: Cookie

Output matches the expected value

Computed when this site was built, by the installed package, which does not run in a browser. The site’s checks recompute it on every change.

Signed-in request: private, no-store

Signed-in request: `private, no-store`