
Research
Security News
The Landscape of Malicious Open Source Packages: 2025 Mid‑Year Threat Report
A look at the top trends in how threat actors are weaponizing open source packages to deliver malware and persist across the software supply chain.
express-cache-controlfreak
Advanced tools
ExpressJS middleware that gives Response objects an intuitive chainable `cache` method to set Cache-Control headers.
Middleware for ExpressJS that defines a cacheControl
method to set Cache-Control
headers.
This middleware doesn't define legacy Expires headers. For compatibility with old HTTP/1.0 agents combine it with express-legacy-expires.
$ npm install express-cache-controlfreak
var cacheControl = require('express-cache-controlfreak');
The function can be used as middleware to set cache control headers in your handler chains.
// Set max age header for this route with the get verb
app.get('/', cacheControl({ maxAge: 300 }), function(req, res, next) {
res.status(200).json({ success: true })
});
This means you can also easily set app-wide cache-control settings.
// Set default no-cache header for the whole app
app.use(cacheControl('no-cache'));
The headers can also be set with the chainable cacheControl
function that is added to the response object.
app.get('/', function(req, res, next) {
res.cacheControl({maxAge: 300})
.status(200)
.json({ success: true });
});
The method added by the module accepts an optional string pattern and an object of Cache-Control options. Both are optional but at least one of them should be specified.
See the HTTP/1.1 Standard's Cache-Control sections for information on the usage of Cache-Control directives.
String patterns are defined for simple directives so you can simply write res.cacheControl("public");
instead of having to always write res.cacheControl({'public': true});
. Properties can be combined with options res.cacheControl("public", {mustRevalidate: true});
.
res.cacheControl("public");
// Cache-Control: public
res.cacheControl("private");
// Cache-Control: private
res.cacheControl("no-cache");
// Cache-Control: no-cache
res.cacheControl("no-store");
// Cache-Control: no-cache, no-store
The max-age header can be set quickly in a similar manner, using a time string or explicit number. By default, the public directive is also added.
res.cacheControl("1h");
// Cache-Control: public, max-age=3600
res.cacheControl(60);
// Cache-Control: public, max-age=60
Simple time strings can be used for setting the max-age
and s-maxage
directives.
See the ms library, which is used to parse the time string, for the syntax.
This is the same library and syntax used by the express sendFile function.
Each Cache-Control response directive defined in HTTP/1.1 has an option that can be defined.
true
for the normal non-field directive and for the with field-name directive accept either a string or an array of strings for the field names.The public, private, no-cache, and no-store directives are exclusive only one may be specified. With the exception that no-cache and no-store may be defined together.
res.cacheControl({'public': true});
// Cache-Control: public
res.cacheControl({'private': true});
// Cache-Control: private
res.cacheControl({'private': "X-Private"});
// Cache-Control: private="X-Private"
res.cacheControl({'private': ["X-Private-1", "X-Private-2"]});
// Cache-Control: private="X-Private-1, X-Private-2"
res.cacheControl({'no-cache': true});
res.cacheControl({noCache: true});
// Cache-Control: no-cache
res.cacheControl({noCache: "X-Uncached"});
// Cache-Control: no-cache="X-Uncached"
res.cacheControl({noCache: ["X-Uncached-1", "X-Uncached-2"]});
// Cache-Control: no-cache="X-Uncached-1, X-Uncached-2"
res.cacheControl({'no-store': true});
res.cacheControl({noStore: true});
// Cache-Control: no-cache, no-store
no-store
also implies no-cache
because some browsers have begone treating no-cache the same way they treat no-store.res.cacheControl({'max-age': 300});
res.cacheControl({maxAge: 300});
// Cache-Control: public, max-age=300
max-age
implies public if none of private, no-cache, or no-store is defined, so you can define it alone.res.cacheControl({'s-maxage': 300});
res.cacheControl({sMaxage: 300});
res.cacheControl({sMaxAge: 300});
// Cache-Control: public, s-maxage=300
s-maxage
supports sMaxAge
in addition to the standard camel-case conversion sMaxage
due to the potential confusion of the max-age
to maxAge
conversion.res.cacheControl({'must-revalidate': true});
res.cacheControl({mustRevalidate: true});
// Cache-Control: must-revalidate
res.cacheControl({'proxy-revalidate': true});
res.cacheControl({proxyRevalidate: true});
// Cache-Control: proxy-revalidate
res.cacheControl({noTransform: true});
res.cacheControl({'no-transform': true});
// Cache-Control: no-transform
FAQs
ExpressJS middleware that gives Response objects an intuitive chainable `cache` method to set Cache-Control headers.
The npm package express-cache-controlfreak receives a total of 160 weekly downloads. As such, express-cache-controlfreak popularity was classified as not popular.
We found that express-cache-controlfreak demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A look at the top trends in how threat actors are weaponizing open source packages to deliver malware and persist across the software supply chain.
Security News
ESLint now supports HTML linting with 48 new rules, expanding its language plugin system to cover more of the modern web development stack.
Security News
CISA is discontinuing official RSS support for KEV and cybersecurity alerts, shifting updates to email and social media, disrupting automation workflows.