[5.x] Prevent protected pages being cached (#10929)

Co-authored-by: Jason Varga <[email protected]>

src/Http/Responses/DataResponse.php

@@ -91,9 +91,13 @@ protected function getRedirect()
 
     protected function protect()
     {
-        app(Protection::class)
-            ->setData($this->data)
-            ->protect();
+        $protection = app(Protection::class)->setData($this->data);
+
+        $protection->protect();
+
+        if ($protection->scheme()) {
+            $this->headers['X-Statamic-Protected'] = true;
+        }
 
         return $this;
     }

src/StaticCaching/Middleware/Cache.php

@@ -179,8 +179,12 @@ private function shouldBeCached($request, $response)
             return false;
         }
 
-        // Draft and private pages should not be cached.
-        if ($response->headers->has('X-Statamic-Draft') || $response->headers->has('X-Statamic-Private')) {
+        // Draft, private and protected pages should not be cached.
+        if (
+            $response->headers->has('X-Statamic-Draft')
+            || $response->headers->has('X-Statamic-Private')
+            || $response->headers->has('X-Statamic-Protected')
+        ) {
             return false;
         }
 

tests/FrontendTest.php

@@ -354,6 +354,25 @@ public function past_private_entries_dont_get_statically_cached()
         $this->markTestIncomplete();
     }
 
+    #[Test]
+    public function header_is_added_to_protected_responses()
+    {
+        $page = $this->createPage('about');
+
+        $this
+            ->get('/about')
+            ->assertOk()
+            ->assertHeaderMissing('X-Statamic-Protected');
+
+        $page->set('protect', 'logged_in')->save();
+
+        $this
+            ->actingAs(User::make())
+            ->get('/about')
+            ->assertOk()
+            ->assertHeader('X-Statamic-Protected', true);
+    }
+
     #[Test]
     public function key_variables_key_added()
     {