3.0.68

changelog.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 2025-02-07 - 3.0.68 - fix(cache-manager)
+Simplify cache control headers in cache manager
+
+- Removed unnecessary cache control headers while setting modern Cache-Control.
+
+## 2025-02-06 - 3.0.67 - fix(serviceworker)
+Enhance header security for cached resources in service worker
+
+- Added Cross-Origin-Resource-Policy header management for service worker cached resources.
+
 ## 2025-02-06 - 3.0.66 - fix(serviceworker)
 Improve error handling and logging in cache manager and update manager.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@api.global/typedserver",
-  "version": "3.0.66",
+  "version": "3.0.68",
   "description": "A TypeScript-based project for easy serving of static files with support for live reloading, compression, and typed requests.",
   "type": "module",
   "exports": {

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@api.global/typedserver',
-  version: '3.0.66',
+  version: '3.0.68',
   description: 'A TypeScript-based project for easy serving of static files with support for live reloading, compression, and typed requests.'
 }

ts_web_serviceworker/classes.cachemanager.ts

@@ -174,11 +174,18 @@ export class CacheManager {
               if (!headers.has('Access-Control-Allow-Headers')) {
                 headers.set('Access-Control-Allow-Headers', 'Content-Type');
               }
-              // Prevent browser caching while allowing ServiceWorker caching.
+              
+              // Set Cross-Origin-Resource-Policy
+              if (matchRequest.url.startsWith(this.losslessServiceWorkerRef.serviceWindowRef.location.origin)) {
+                // For same-origin resources
+                headers.set('Cross-Origin-Resource-Policy', 'same-origin');
+              } else {
+                // For cross-origin resources that we explicitly allow
+                headers.set('Cross-Origin-Resource-Policy', 'cross-origin');
+              }
+
+              // Set caching headers - use modern Cache-Control only
               headers.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
-              headers.set('Pragma', 'no-cache');
-              headers.set('Expires', '0');
-              headers.set('Surrogate-Control', 'no-store');
 
               // IMPORTANT: Read the full response body as a blob to avoid issues (e.g., Safari locked streams).
               const bodyBlob = await responseToPutToCache.blob();