Allow using combine the Cache-Control `public` and `no-cache` headers

Since #30367, if `no-cache` includes Cache-Control headers, special keys
like `public`, `must-revalidate` are ignored.
But in my understanding, `public` still need in case of want to cache
authenticated pages.
The authenticated pages to be cacheable, but still authenticated for
every user, need to specify the `Cache-Control: public, no-cache`.

For keys other than `public`, I did not know the case where it was
necessary to use it in combination with `no-cache`, so I fixed that can
be used only for `public`.

Ref: https://www.mnot.net/cache_docs/#CACHE-CONTROL

Fixes #34780.

1 files changed, 6 insertions, 4 deletions

diff --git a/actionpack/lib/action_dispatch/http/cache.rb b/actionpack/lib/action_dispatch/http/cache.rb
index f67b13f657..8cc84ff36c 100644
--- a/actionpack/lib/action_dispatch/http/cache.rb
+++ b/actionpack/lib/action_dispatch/http/cache.rb
@@ -197,10 +197,12 @@ module ActionDispatch
           if control.empty?
             # Let middleware handle default behavior
           elsif control[:no_cache]
-            self._cache_control = NO_CACHE
-            if control[:extras]
-              self._cache_control = _cache_control + ", #{control[:extras].join(', ')}"
-            end
+            options = []
+            options << PUBLIC if control[:public]
+            options << NO_CACHE
+            options.concat(control[:extras]) if control[:extras]
+
+            self._cache_control = options.join(", ")
           else
             extras = control[:extras]
             max_age = control[:max_age]