cache: Enforce no-caching on the client side

Adding http headers to enforce requests are not cached by the browser.

server.go

@@ -101,6 +101,9 @@ func (s *server) authenticate(w http.ResponseWriter, r *http.Request) {
 	logger := logger.ForRequest(r, logModuleInfo)
 	logger.Info("Authenticating request...")
 
+	// Enforce no caching on the browser side.
+	w.Header().Add("Cache-Control", "private, max-age=0, no-cache, no-store")
+
 	var user *authenticator.User
 	for i, auth := range s.authenticators {
 		logger.Infof("%s starting...", strings.Title(authenticatorsMapping[i]))
@@ -206,6 +209,9 @@ func (s *server) callback(w http.ResponseWriter, r *http.Request) {
 
 	logger := logger.ForRequest(r, logModuleInfo)
 
+	// Enforce no caching on the browser side.
+	w.Header().Add("Cache-Control", "private, max-age=0, no-cache, no-store")
+
 	// Get authorization code from authorization response.
 	var authCode = r.FormValue("code")
 	if len(authCode) == 0 {