cache: Enforce no-caching on the client side

Adding http headers to enforce requests are not cached by the browser.

server.go

@@ -165,6 +165,9 @@ func (s *server) authenticate(w http.ResponseWriter, r *http.Request, promptLogi
 	logger := common.LoggerForRequest(r, logModuleInfo)
 	logger.Info("Authenticating request...")
 
+	// Enforce no caching on the browser side.
+	w.Header().Add("Cache-Control", "private, max-age=0, no-cache, no-store")
+
 	// Try each one of the available enabled authenticators, if none of them
 	// achieves to authenticate the request then userInfo will be nil and
 	// Authorization Code Flow will begin.
@@ -374,6 +377,9 @@ func (s *server) callback(w http.ResponseWriter, r *http.Request) {
 
 	logger := common.LoggerForRequest(r, logModuleInfo)
 
+	// Enforce no caching on the browser side.
+	w.Header().Add("Cache-Control", "private, max-age=0, no-cache, no-store")
+
 	// Get authorization code from authorization response.
 	var authCode = r.FormValue("code")
 	if len(authCode) == 0 {