Debug/error pages are not cache-controlled (no Cache-Control: no-store)

[bigpresh]

Summary

Dancer error pages and debug output carry no cache-control headers, so error responses (including debug pages that dump the request ENV and session data) can be cached by shared/intermediary caches and served to later visitors. Found during an AI-powered sweep of the codebase for quality & security.

Details

• Dancer::Error::render / _render_html / _render_serialized (lib/Dancer/Error.pm:190-271) build responses with no Cache-Control/no-store/Vary headers.
• Dancer::Handler::render_response (lib/Dancer/Handler.pm:142-194) sends error responses through the normal path without any default cache headers.
• Dancer::Renderer::render_error (lib/Dancer/Renderer.pm:38-55) serves $error.html statics with the request content-type and no cache headers either.

In a default (development) setup, show_errors renders the full request ENV (including HTTP_COOKIE — see the separate security advisory about the error page) — and that output is cacheable in the absence of cache headers. Error pages also lack Vary: Accept/Vary: Origin. Combined with issue #774 (sessions auto-created per request) error/favicon-type hits can also drive session-file growth, but the cacheing issue here is separate.

Fix direction

• Always emit Cache-Control: no-store (and ideally Vary: * or Vary: Origin) for 4xx/5xx responses when show_errors is enabled (or always for error pages).
• Consider Vary on successful HTML responses that depend on headers.

Notes

• Dancer 1 is in maintenance mode (all new dev on Dancer 2); this may not be fixed, and any fix should be evaluated for backwards-incompatibility.