From b136da4f6f92ae938bc9f439681acd40261e453c Mon Sep 17 00:00:00 2001
From: ddang175 <ddanton175@gmail.com>
Date: Tue, 28 Apr 2026 11:38:11 -0500
Subject: [PATCH] fix: set consistent Cache-Control header for static assets

Static assets were receiving two conflicting Cache-Control headers:
- 'public, max-age=43200' from the static file handler
- 'no-store, no-cache, must-revalidate' overriding it

This fix explicitly sets 'public, max-age=43200' for /static and
/admin/static paths in the after_request hook, ensuring browsers
and reverse proxies can correctly cache static assets.

Closes #1197
---
 server.py | 56 ++++++++++++++++++++++++++++++-------------------------
 1 file changed, 31 insertions(+), 25 deletions(-)

diff --git a/server.py b/server.py
index 36752908d..ebcaaa0dd 100644
--- a/server.py
+++ b/server.py
@@ -244,33 +244,39 @@ def before_request():
             if ref_code:
                 session["slref"] = ref_code
 
-    @app.after_request
-    def after_request(res):
-        # not logging /static call
-        if (
-            not request.path.startswith("/static")
-            and not request.path.startswith("/admin/static")
-            and not request.path.startswith("/_debug_toolbar")
-            and not request.path.startswith("/git")
-            and not request.path.startswith("/favicon.ico")
-            and not request.path.startswith("/health")
-        ):
-            start_time = g.start_time or time.time()
-            LOG.d(
-                "%s %s %s %s %s, takes %s",
-                request.remote_addr,
-                request.method,
-                request.path,
-                request.args,
-                res.status_code,
-                time.time() - start_time,
-            )
-            newrelic.agent.record_custom_event(
-                "HttpResponseStatus", {"code": res.status_code}
-            )
-            send_version_event("app")
+@app.after_request
+def after_request(res):
+    # Set proper Cache-Control for static assets to allow caching
+    if request.path.startswith("/static") or request.path.startswith(
+        "/admin/static"
+    ):
+        # Allow static files to be cached for 12 hours
+        res.headers["Cache-Control"] = "public, max-age=43200"
         return res
 
+    # not logging /static call
+    if (
+        not request.path.startswith("/_debug_toolbar")
+        and not request.path.startswith("/git")
+        and not request.path.startswith("/favicon.ico")
+        and not request.path.startswith("/health")
+    ):
+        start_time = g.start_time or time.time()
+        LOG.d(
+            "%s %s %s %s %s, takes %s",
+            request.remote_addr,
+            request.method,
+            request.path,
+            request.args,
+            res.status_code,
+            time.time() - start_time,
+        )
+        newrelic.agent.record_custom_event(
+            "HttpResponseStatus", {"code": res.status_code}
+        )
+        send_version_event("app")
+    return res
+
 
 def setup_openid_metadata(app):
     @app.route("/.well-known/openid-configuration")