Set Cache-Control: no-store

src/server/auth/handlers/authorize.ts

@@ -52,6 +52,8 @@ export function authorizationHandler({ provider, rateLimit: rateLimitConfig }: A
 
   // Define the handler
   router.all("/", async (req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+
     let client_id, redirect_uri;
     try {
       const data = req.method === 'POST' ? req.body : req.query;

src/server/auth/handlers/register.ts

@@ -63,6 +63,8 @@ export function clientRegistrationHandler({
   }
 
   router.post("/", async (req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+
     let clientMetadata;
     try {
       clientMetadata = OAuthClientMetadataSchema.parse(req.body);

src/server/auth/handlers/revoke.ts

@@ -48,6 +48,8 @@ export function revocationHandler({ provider, rateLimit: rateLimitConfig }: Revo
   router.use(authenticateClient({ clientsStore: provider.clientsStore }));
 
   router.post("/", async (req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+
     let revocationRequest;
     try {
       revocationRequest = OAuthTokenRevocationRequestSchema.parse(req.body);

src/server/auth/handlers/token.ts

@@ -59,6 +59,8 @@ export function tokenHandler({ provider, rateLimit: rateLimitConfig }: TokenHand
   router.use(authenticateClient({ clientsStore: provider.clientsStore }));
 
   router.post("/", async (req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+
     let grant_type;
     try {
       ({ grant_type } = TokenRequestSchema.parse(req.body));