Nocache Middleware
The `nocache` package is an Express/Connect middleware designed to aggressively disable client-side caching by setting specific HTTP response headers. It is currently at stable version 4.0.0. As a component of the Helmet.js suite, its release cadence is generally tied to Helmet's, focusing on stability and security rather than frequent feature additions, with major version updates typically aligning with Node.js EOLs or significant breaking changes. Its primary differentiator is its simplicity and integration within the broader Helmet.js ecosystem, providing a straightforward, opinionated way to ensure clients always request fresh resources. This is crucial for applications sensitive to stale data, enforcing immediate updates, or handling sensitive information that should never reside in a browser cache. It effectively sets `Cache-Control`, `Expires`, and `Surrogate-Control` headers.
Common errors
-
TypeError: nocache is not a function
cause This error typically occurs when `nocache` is passed directly to `app.use()` without being called as a function, e.g., `app.use(nocache);`.fixThe `nocache` export is a factory function that returns the actual middleware. You must call it, even with no arguments, before passing its result to `app.use()`: `app.use(nocache());`.
Warnings
- breaking Version 4.0.0 of `nocache` updated its minimum Node.js engine requirement to `>=16.0.0`. Older Node.js versions are not officially supported and may encounter issues.
- gotcha Applying `nocache` globally to an Express application can have significant performance implications for your users and server. By disabling all client-side caching, every asset (HTML, CSS, JS, images) must be re-downloaded on each request, increasing network traffic and server load.
- gotcha The `nocache` middleware sets specific HTTP headers (`Cache-Control`, `Expires`, `Surrogate-Control`). If other middleware, your web server (e.g., Nginx, Apache), or a reverse proxy also manipulates caching headers, there might be conflicts or unintended behavior where `nocache`'s headers are overwritten or fail to take effect as expected.
Install
-
npm install nocache -
yarn add nocache -
pnpm add nocache
Imports
- nocache
const nocache = require('nocache'); // CommonJS is still supported but ESM is preferred in modern applications.import nocache from 'nocache';
- nocache
import nocache from 'nocache'; // While possible, for CJS-only projects, 'require' is the correct syntax.
const nocache = require('nocache');
Quickstart
import express from 'express';
import nocache from 'nocache';
const app = express();
const port = process.env.PORT ?? 3000;
// Apply the nocache middleware globally to all routes.
// This ensures that all responses from this server attempt to disable client-side caching.
app.use(nocache());
app.get('/', (req, res) => {
res.send('<h1>Welcome!</h1><p>This content should not be cached by your browser.</p>');
});
app.get('/api/data', (req, res) => {
// Even API endpoints will have caching headers applied, forcing fresh requests.
res.json({ message: 'Dynamic data from API', timestamp: new Date().toISOString() });
});
app.listen(port, () => {
console.log(`Nocache server listening on port ${port}`);
console.log('Inspect network requests in your browser to see Cache-Control, Expires, and Surrogate-Control headers set to disable caching.');
});