Security: Refactor cache headers, auth token validation & UI #782 #808

Signed-off-by: Michael Mayer <michael@photoprism.app>

internal/api/session_create.go

@@ -20,9 +20,6 @@ import (
 // POST /api/v1/sessions
 func CreateSession(router *gin.RouterGroup) {
 	createSessionHandler := func(c *gin.Context) {
-		// Disable caching of responses.
-		c.Header(header.CacheControl, header.CacheControlNoStore)
-
 		// Prevent CDNs from caching this endpoint.
 		if header.IsCdn(c.Request) {
 			AbortNotFound(c)
@@ -40,6 +37,9 @@ func CreateSession(router *gin.RouterGroup) {
 			return
 		}
 
+		// Disable caching of responses.
+		c.Header(header.CacheControl, header.CacheControlNoStore)
+
 		conf := get.Config()
 
 		// Skip authentication if app is running in public mode.