Fixes #723 - Add no-store header for embedded js (#724)

internal/web/handlers/gist/gist.go

@@ -191,6 +191,7 @@ func GistJs(ctx *context.Context) error {
 	if err != nil {
 		return ctx.ErrorRes(500, "Error escaping JavaScript content", err)
 	}
+	ctx.Response().Header().Set("Cache-Control", "no-store")
 	ctx.Response().Header().Set("Content-Type", "text/javascript")
 	return ctx.PlainText(200, js)
 }

internal/web/handlers/gist/gist_test.go

@@ -384,6 +384,13 @@ func TestGistJsSingleFile(t *testing.T) {
 		assert.Contains(t, string(body), "prefers-color-scheme")
 	})
 
+	t.Run("NoCacheHeader", func(t *testing.T) {
+		_, _, username, identifier := s.CreateGist(t, "0")
+
+		resp := s.Request(t, "GET", "/"+username+"/"+identifier+".js", nil, 200)
+		assert.Equal(t, "no-store", resp.Header.Get("Cache-Control"))
+	})
+
 	t.Run("PrivateGist", func(t *testing.T) {
 		_, _, username, identifier := s.CreateGist(t, "2")