Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

routing.headers cannot set Cache-Control on static assets

Open
  • Is something wrong?
#579 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
56/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
backend

Research direction

Start by reading headerMiddleware in dist/runtime/routing.mjs, then inspect stampClientAssetCachePolicy and the routing runtime tests. Reproduce the CSS and JS behavior with vp build and vp preview, and check how the fix affects 404 responses. Done means the acceptance checklist passes in preview and Cloudflare deploy, with tests and docs covering the 404 policy.

Written by the indexing model from the issue text.

Description

routing.headers cannot set Cache-Control on static assets

What happens

With Void 1.1.12 (the runtime code is the same in 1.2.1), this rule has no effect on static assets:

routing: {
  headers: {
    '/assets/*': ['Cache-Control: public, max-age=31536000, immutable'],
  },
},

A CSS file, a font or an image under /assets/ still answers cache-control: public, max-age=0, must-revalidate. Other headers in the same rule, such as X-Robots-Tag, do arrive.

The rule also makes JavaScript worse. stampClientAssetCachePolicy removes immutableFiles for every chunk an authored Cache-Control pattern matches. So JS chunks lose the built-in immutable policy, and the authored policy never applies either.

The docs say the opposite should happen. guide/edge/headers.md says "User-defined Cache-Control overrides the built-in default", and guide/edge/static-assets.md suggests routing.headers for CSS and other assets.

Cause

headerMiddleware in dist/runtime/routing.mjs runs after next() and assigns a new response:

const headers = new Headers(c.res.headers);
for (const [name, value] of matched) headers.set(name, value);
c.res = new Response(c.res.body, { headers, status: c.res.status, statusText: c.res.statusText });

Hono's set res copies every header of the previous #res onto the new response, except content-type and set-cookie. The previous response is the asset binding's response, which carries cache-control: public, max-age=0, must-revalidate. That value overwrites the authored one. Headers the old response lacks, such as X-Robots-Tag, survive, which hides the bug.

Reproduce
  1. In a static Void app with output: 'static', add the rule above.
  2. Run vp build, then vp preview.
  3. Run curl -s -D - -o /dev/null http://127.0.0.1:<port>/assets/<any>.css. The response shows cache-control: public, max-age=0, must-revalidate.
  4. Request a JS chunk the same way. It now also shows max-age=0, must-revalidate, where it showed immutable before the rule was added.
Fix we apply locally

Clear the context's response before you assign the new one, so Hono has nothing to merge:

const response = new Response(c.res.body, { headers, status: c.res.status, statusText: c.res.statusText });
c.res = void 0;
c.res = response;

Aureum carries this as patches/void.patch.

Also worth deciding

Header rules apply to every status. With the fix in place, /assets/missing.css answers 404 with immutable, so a browser can cache the 404 for a year. A deploy that briefly serves new HTML from one version and assets from another could leave a visitor with a stylesheet that stays broken. Consider applying authored Cache-Control to successful responses only, or document that it applies to every status.

Acceptance checklist
  • A routing.headers rule that sets Cache-Control for /assets/* reaches CSS, font and image responses in vp preview and in a Cloudflare deploy.
  • JS chunks under the same pattern answer with the authored Cache-Control.
  • Pages and other paths the rule does not match keep their default Cache-Control.
  • A test in the routing runtime covers an authored header that the asset response already carries.
  • The docs state whether authored Cache-Control applies to 404 responses.
Dominant language
TypeScript
Stars
580
Forks
56
Avg merge
11h 32m
Merged PRs (30d)
158

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from voidzero-dev/void

All issues in voidzero-dev/void

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.