From fdc4a6ae680fda6c92218f72dfc91a578eba4051 Mon Sep 17 00:00:00 2001
From: evanpelle <evanpelle@gmail.com>
Date: Sun, 3 May 2026 21:32:45 -0600
Subject: [PATCH] no cache

---
 src/server/RenderHtml.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/server/RenderHtml.ts b/src/server/RenderHtml.ts
index f2706ca6f..d7a334a97 100644
--- a/src/server/RenderHtml.ts
+++ b/src/server/RenderHtml.ts
@@ -77,6 +77,10 @@ export async function renderAppShell(
   htmlPath: string,
 ): Promise<void> {
   const rendered = await getAppShellContent(htmlPath);
-  setAppShellCacheHeaders(res);
+  // Cannot edge-cache the app shell: Cloudflare's auto-CSP rotates the
+  // nonce in the response header on every request, but a cached body
+  // freezes the nonces in inline <script> tags. The mismatch blocks all
+  // inline scripts (incl. Turnstile's srcdoc iframes) on cache hits.
+  setHtmlNoCacheHeaders(res);
   res.send(rendered);
 }