Proxito: add Cache-Control HTTP headers (#12348)

Always add `Cache-Control` to external domains.

Closes #12244

Author: humitos

dockerfiles/nginx/proxito.conf.template

@@ -77,6 +77,8 @@ server {
         add_header X-RTD-Resolver-Filename $rtd_resolver_filename always;
         set $cdn_cache_control $upstream_http_cdn_cache_control;
         add_header CDN-Cache-Control $cdn_cache_control always;
+        set $cache_control $upstream_http_cache_control;
+        add_header Cache-Control $cache_control always;
         set $cache_tag $upstream_http_cache_tag;
         add_header Cache-Tag $cache_tag always;
         set $referrer_policy $upstream_http_referrer_policy;

readthedocs/proxito/middleware.py

@@ -159,6 +159,12 @@ def add_hsts_headers(self, request, response):
             response["Strict-Transport-Security"] = "; ".join(hsts_header_values)
 
     def add_cache_headers(self, request, response):
+        """Add `Cache-Control: no-cache` header (browser level) for external versions."""
+        unresolved_domain = request.unresolved_domain
+        if unresolved_domain and unresolved_domain.is_from_external_domain:
+            response["Cache-Control"] = "no-cache"
+
+    def add_cdn_cache_headers(self, request, response):
         """
         Add Cache-Control headers.
 
@@ -360,6 +366,7 @@ def add_resolver_headers(self, request, response):
     def process_response(self, request, response):  # noqa
         self.add_proxito_headers(request, response)
         self.add_cache_headers(request, response)
+        self.add_cdn_cache_headers(request, response)
         self.add_hsts_headers(request, response)
         self.add_user_headers(request, response)
         self.add_hosting_integrations_headers(request, response)

readthedocs/proxito/tests/test_headers.py

@@ -372,3 +372,27 @@ def test_cache_headers_robots_txt_with_private_projects_allowed(self):
         self.assertEqual(r.status_code, 200)
         self.assertEqual(r["CDN-Cache-Control"], "public")
         self.assertEqual(r["Cache-Tag"], "project,project:sitemap.xml")
+
+    def test_cache_headers_at_browser_level_on_external_domain(self):
+        r = self.client.get(
+            "/en/latest/", secure=True, headers={"host": "project.dev.readthedocs.io"}
+        )
+        self.assertEqual(r.status_code, 200)
+        self.assertNotIn("no-cache", r.headers)
+
+        get(
+            Version,
+            project=self.project,
+            slug="111",
+            active=True,
+            privacy_level=PUBLIC,
+            type=EXTERNAL,
+        )
+
+        r = self.client.get(
+            "/en/111/",
+            secure=True,
+            headers={"host": "project--111.dev.readthedocs.build"},
+        )
+        self.assertEqual(r.status_code, 200)
+        self.assertEqual(r["Cache-Control"], "no-cache")