http: add cache-control headers to prevent caching by other proxies elsewhere

lib/action/code.go

@@ -42,7 +42,11 @@ type CodeSettings struct {
 type Code int
 
 func (a Code) Handle(logger *slog.Logger, w http.ResponseWriter, r *http.Request, done func() (backend http.Handler)) (next bool, err error) {
-	challenge.RequestDataFromContext(r.Context()).ResponseHeaders(w)
+	data := challenge.RequestDataFromContext(r.Context())
+
+	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+
+	data.ResponseHeaders(w)
 
 	w.WriteHeader(int(a))
 	return false, nil