nocache

nocache is a minimal middleware for Express and Connect-based Node.js applications that disables client-side and proxy caching of HTTP responses. It works by setting three response headers — Cache-Control, Expires, and Surrogate-Control — that instruct browsers, CDNs, and intermediate proxies not to store or reuse a response.

The package originated as part of Helmet, the popular security-headers middleware collection, and was later split out into its own module maintained under the helmetjs GitHub organization. It has no runtime dependencies, a single-file implementation, and bundled TypeScript type declarations, making it a drop-in addition to any Express or Connect app that needs to guarantee fresh responses.

What You Get

• A single middleware function that sets three no-cache related HTTP headers in one call
• Zero runtime dependencies, keeping the package footprint minimal
• Bundled TypeScript type declarations (index.d.ts) for typed Express/Connect usage
• A documented changelog tracking every breaking header/behavior change since v2.1.0

Common Use Cases

• Disabling caching on API endpoints that return frequently changing or sensitive data
• Ensuring authenticated pages are never served stale from a shared proxy or browser cache
• Preventing intermediate CDNs from serving outdated responses during active development or after a deploy
• Forcing clients to always re-fetch a resource after invalidating an old cached version

Under The Hood

Architecture The entire implementation lives in a single nine-line file, index.js, which exports a factory function (nocache) that returns a named Express/Connect-style (req, res, next) handler. There are no internal layers, no configuration options, and no state — the returned middleware calls res.setHeader three times and immediately invokes next(). This is intentional: the package does exactly one thing (write cache-defeating headers) and nothing else, so there is no abstraction to trace beyond the single function body.

Tech Stack The package is plain CommonJS JavaScript with a hand-written index.d.ts for TypeScript consumers, requiring Node.js 24+ per package.json engines. It has zero runtime dependencies; its only devDependencies are eslint (10.x) with @eslint/js and globals, and prettier (3.x), used purely for linting/formatting. There is no build step — the source ships as-is — and CI (GitHub Actions, nodejs.yml) runs npm test against a Node 24.x/26.x matrix.

Code Quality A small but meaningful test suite (test.js) uses Node’s built-in node:test and node:assert/strict to verify both the exact header values set and that the exported function and its returned middleware are each named nocache (useful for stack traces). pretest runs ESLint and a Prettier check before tests execute, and CI enforces this on every push across two Node versions. There are no type-safety guarantees for the JS source itself (types are hand-authored separately, not derived from TypeScript source), but the surface area is small enough that this is a low-risk gap.

What Makes It Unique nocache is not attempting to innovate — it packages three well-known, standard HTTP cache-control headers behind one function call. Its only distinguishing trait is provenance: it was extracted from Helmet, the widely-used security-headers middleware, when Helmet’s maintainers split rarely-needed features into standalone packages. Its value is being a trusted, zero-dependency, actively-maintained single-purpose utility rather than any novel technical approach.