ETag is not removed

[cressie176]

  app.use(nocache({ noEtag: true }));

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate
ETag: W/"P9t1QDzaUOacnsgSyeCP3g=="
Expires: 0
Pragma: no-cache

[EvanHahn]

Investigating this now.

[EvanHahn]

I can't reproduce this. Do you possibly have another middleware after nocache that's setting ETags?

[EvanHahn]

@cressie176 Can you reproduce this problem?

[cressie176]

Trying now

[cressie176]

Thanks for investigating. Sample project demonstrating the issue here...
https://github.com/cressie176/nocache-issue-9

[cressie176]

I suspect the problem is that app.use is defined before the route, so the ETag is added after nocache middleware is run. Moving app.use after the route won't help since it doesn't call next, and nocache won't be run at all.

[EvanHahn]

When you call res.send, Express will set an ETag by default. You can disable it:

app.disable('etag')

This should solve your problem!

[cressie176]

Hi Evan,

Thanks for responding. I know about app.disable('etag'). I originally had this set, but when I saw that nocache had an option for "crushing" the etag, assumed this is what it would do.

Given that nocache does not (and cannot) do what it says on the tin without wrapping the send function in a similar way to express-winston, I'd suggest deprecating this config option - it's misleading.

[analog-nico]

@cressie176 To selectively remove the etag header for certain responses you may use:

var onHeaders = require('on-headers');

onHeaders(res, function () {
    this.removeHeader('ETag');
});

on-headers provides a hook which is executed at the very end before the response is sent. Only at this point the etag header already exists. A regular middleware couldn't delete it because it is not yet created when the middleware is executed.

@EvanHahn As far as I can tell the current implementation of the noEtag cannot work. I would either remove it or replace it with the solution above.

[EvanHahn]

I do agree that it's misleading. noEtag works as designed, but the design is basically wrong—it only removes ETags that have already been set, not ones that will be set in the future by things like res.send.

We should deprecate this option. See #10.