first

apps/core/middleware.py

@@ -0,0 +1,13 @@
+class NoStoreHTMLMiddleware:
+    """Prevent browsers and installed PWAs from retaining authenticated HTML views."""
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        response = self.get_response(request)
+        if response.get("Content-Type", "").lower().startswith("text/html"):
+            response["Cache-Control"] = "private, no-cache, no-store, must-revalidate"
+            response["Pragma"] = "no-cache"
+            response["Expires"] = "0"
+        return response