fix: use no-cache for local urls and updates

src/background/utils/update.js

@@ -38,9 +38,6 @@ async function checkAllAndNotify(scripts) {
 }
 
 const processes = {};
-const NO_HTTP_CACHE = {
-  'Cache-Control': 'no-cache, no-store, must-revalidate',
-};
 
 // resolves to true if successfully updated
 function checkUpdate(script, notes) {
@@ -61,7 +58,7 @@ async function doCheckUpdate(script, notes) {
       update: { checking: false },
     });
     msgOk = i18n('msgScriptUpdated', [getScriptName(update)]);
-    resourceOpts = { headers: NO_HTTP_CACHE };
+    resourceOpts = { cache: 'no-cache' };
     return true;
   } catch (update) {
     msgErr = update.error;
@@ -93,7 +90,9 @@ async function downloadUpdate({ props: { id }, meta, custom }) {
   announce(i18n('msgCheckingForUpdate'));
   try {
     const { data } = await request(updateURL, {
-      headers: { ...NO_HTTP_CACHE, Accept: 'text/x-userscript-meta,*/*' },
+      // TODO: do a HEAD request first to get ETag header and compare to storage.mod
+      cache: 'no-cache',
+      headers: { Accept: 'text/x-userscript-meta,*/*' },
     });
     const { version } = parseMeta(data);
     if (compareVersion(meta.version, version) >= 0) {
@@ -103,7 +102,7 @@ async function downloadUpdate({ props: { id }, meta, custom }) {
     } else {
       announce(i18n('msgUpdating'));
       errorMessage = i18n('msgErrorFetchingScript');
-      return (await request(downloadURL, { headers: NO_HTTP_CACHE })).data;
+      return (await request(downloadURL, { cache: 'no-cache' })).data;
     }
   } catch (error) {
     if (process.env.DEBUG) console.error(error);

src/common/index.js

@@ -149,10 +149,6 @@ export function getFullUrl(url, base) {
   return obj.href;
 }
 
-export function isRemote(url) {
-  return url && !(/^(file:|data:|https?:\/\/localhost[:/]|http:\/\/127\.0\.0\.1[:/])/.test(url));
-}
-
 export function encodeFilename(name) {
   // `escape` generated URI has % in it
   return name.replace(/[-\\/:*?"<>|%\s]/g, (m) => {

src/common/util.js

@@ -257,6 +257,10 @@ export async function requestLocalFile(url, options = {}) {
 const FORCED_ACCEPT = {
   'greasyfork.org': 'application/javascript, text/plain, text/css',
 };
+
+export const isRemote = url => url
+  && !(/^(file:|data:|https?:\/\/(localhost|127\.0\.0\.1[:/]))/.test(url));
+
 /** @typedef {{
   url: string,
   status: number,
@@ -272,13 +276,13 @@ const FORCED_ACCEPT = {
 export async function request(url, options = {}) {
   // fetch does not support local file
   if (url.startsWith('file://')) return requestLocalFile(url, options);
-  const { body, credentials, headers, method, responseType } = options;
+  const { body, headers, responseType } = options;
   const isBodyObj = body && body::({}).toString() === '[object Object]';
   const hostname = url.split('/', 3)[2];
   const accept = FORCED_ACCEPT[hostname];
   const init = {
-    credentials,
-    method,
+    cache: isRemote(url) ? undefined : 'no-cache',
+    ...options, /* Used in safe context */// eslint-disable-line no-restricted-syntax
     body: isBodyObj ? JSON.stringify(body) : body,
     headers: isBodyObj || accept
       ? Object.assign({},