@@ -453,6 +453,7 @@ func (p *OAuthProxy) ErrorPage(rw http.ResponseWriter, code int, title string, m
453453
454454// SignInPage writes the sing in template to the response
455455func (p *OAuthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code int) {
456+ prepareNoCache(rw)
456457 p.ClearSessionCookie(rw, req)
457458 rw.WriteHeader(code)
458459
@@ -633,7 +634,26 @@ func getRemoteAddr(req *http.Request) (s string) {
633634 return
634635}
635636
637+// See https://developers.google.com/web/fundamentals/performance/optimizing-content-efficiency/http-caching?hl=en
638+var noCacheHeaders = map[string]string{
639+ "Expires": time.Unix(0, 0).Format(time.RFC1123),
640+ "Cache-Control": "no-cache, no-store, must-revalidate, max-age=0",
641+ "X-Accel-Expires": "0", // https://www.nginx.com/resources/wiki/start/topics/examples/x-accel/
642+}
643+
644+// prepareNoCache prepares headers for preventing browser caching.
645+func prepareNoCache(w http.ResponseWriter) {
646+ // Set NoCache headers
647+ for k, v := range noCacheHeaders {
648+ w.Header().Set(k, v)
649+ }
650+}
651+
636652func (p *OAuthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
653+ if strings.HasPrefix(req.URL.Path, p.ProxyPrefix) {
654+ prepareNoCache(rw)
655+ }
656+
637657 switch path := req.URL.Path; {
638658 case path == p.RobotsPath:
639659 p.RobotsTxt(rw)
@@ -715,6 +735,7 @@ func (p *OAuthProxy) SignOut(rw http.ResponseWriter, req *http.Request) {
715735
716736// OAuthStart starts the OAuth2 authentication flow
717737func (p *OAuthProxy) OAuthStart(rw http.ResponseWriter, req *http.Request) {
738+ prepareNoCache(rw)
718739 nonce, err := encryption.Nonce()
719740 if err != nil {
720741 logger.Printf("Error obtaining nonce: %s", err.Error())