From f0e2ffa9d1275514932104e9db446cff95a43883 Mon Sep 17 00:00:00 2001
From: "Brian J. Geiger" <bgeiger@pobox.com>
Date: Wed, 30 Sep 2026 14:36:10 -0400
Subject: [PATCH] =?UTF-8?q?Revert=20"[ENG-11824]=20fix(cors):=20always=20s?=
 =?UTF-8?q?end=20Cache-Control:=20no-store=20even=20witho=E2=80=A6"?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit 7f101d1f40deaaae8415bcefcf68696a9bee9db6.
---
 mfr/server/handlers/core.py        | 7 +------
 tests/server/handlers/test_cors.py | 9 ---------
 2 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/mfr/server/handlers/core.py b/mfr/server/handlers/core.py
index a8fc1324..3375f3e1 100644
--- a/mfr/server/handlers/core.py
+++ b/mfr/server/handlers/core.py
@@ -47,12 +47,6 @@ def _cross_origin_is_allowed(self):
         return False
 
     def set_default_headers(self):
-        # Always disable caching, even when no ``Origin`` header is present (e.g. a plain
-        # ``<iframe src="...">`` navigation). Without this, responses carry no caching
-        # directive at all in that case, leaving any intermediary (CDN, proxy, browser) free
-        # to apply its own heuristic caching to a render response.
-        self.set_header('Cache-control', 'no-store, no-cache, must-revalidate, max-age=0')
-
         if not self.request.headers.get('Origin'):
             return
 
@@ -76,6 +70,7 @@ def set_default_headers(self):
         self.set_header('Access-Control-Allow-Credentials', 'true')
         self.set_header('Access-Control-Allow-Headers', ', '.join(CORS_ACCEPT_HEADERS))
         self.set_header('Access-Control-Expose-Headers', ', '.join(CORS_EXPOSE_HEADERS))
+        self.set_header('Cache-control', 'no-store, no-cache, must-revalidate, max-age=0')
 
     def options(self):
         self.set_status(204)
diff --git a/tests/server/handlers/test_cors.py b/tests/server/handlers/test_cors.py
index 8f7974b5..5f2b245f 100644
--- a/tests/server/handlers/test_cors.py
+++ b/tests/server/handlers/test_cors.py
@@ -166,12 +166,3 @@ def test_no_origin_means_no_cors(self):
             assert 'Access-Control-Allow-Credentials' not in self.handler.headers
             assert 'Access-Control-Allow-Headers' not in self.handler.headers
             assert 'Access-Control-Expose-Headers' not in self.handler.headers
-
-    @testing.gen_test
-    def test_no_origin_still_disables_caching(self):
-        for method in ('OPTIONS', 'HEAD' 'GET', 'POST', 'PUT', 'PATCH', 'DELETE'):
-            self.handler.request = MockRequest(
-                method=method,
-            )
-            self.handler.set_default_headers()
-            assert self.handler.headers['Cache-control'] == 'no-store, no-cache, must-revalidate, max-age=0'