Add NoCache middleware for authenticated pages (closes #61)

internal/middleware/middleware.go

@@ -265,6 +265,26 @@ func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
 	}
 }
 
+// NoCache returns middleware that instructs browsers and
+// intermediary proxies not to cache the response. It sets
+// Cache-Control: no-store and Pragma: no-cache (the latter for
+// older HTTP/1.0 intermediaries). Apply it to authenticated pages
+// so webhook configuration and captured event data are not stored
+// by caches.
+func (s *Middleware) NoCache() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(
+			w http.ResponseWriter,
+			r *http.Request,
+		) {
+			w.Header().Set("Cache-Control", "no-store")
+			w.Header().Set("Pragma", "no-cache")
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
 // MaxBodySize returns middleware that limits the request body size
 // for POST requests. If the body exceeds the given limit in
 // bytes, the server returns 413 Request Entity Too Large. This