Pages with session messages should never be cached

[mahagr]

Session messages should prevent caching in both Grav and in the browser.

[mahagr]

Fixed in Grav 1.7 branch.

[NicoHood]

I am not yet understanding how this works, could you maybe go more into details?

For example:
I've written a rating plugin with email verification. Once you click the link you end on the page that was rated + a thank you message. However if the page was cached in first place, this message will never be shown, as the browser will still load it from the cache. I am not sure about subsequent requests. Is this covered? This sounds tricky to me (except changing cache settings globally)

[mahagr]

It does not fix cached pages, it just fixes messages like "You login has failed", "Entry saved" etc from being cached into browser or proxy. So information leaks from one user to another.

Like I said, forms are a separate issue altogether.