From 7a90c266d3f6bbe3fee43d0e4f90b0155205da99 Mon Sep 17 00:00:00 2001
From: jm <jm@maz>
Date: Thu, 22 Oct 2026 13:30:30 +0200
Subject: [PATCH 1/7] feat(ssr): opt-in loopback endpoint listing the SSR cache
 contents

cache.serverSide.statsPort (default 0 = off) starts an HTTP server on
127.0.0.1:<port + NODE_APP_INSTANCE> serving GET /app/cache-stats as HTML
or ?format=json: per-cache entry count vs limit, stale count, HTML bytes
and remaining TTL per entry, process RSS/heap. Snapshots use LRU.dump()
so expired-but-resident entries are reported even with allowStale:false.
A failed bind is logged and never stops the UI.
---
 .github/workflows/build.yml          |   3 +
 config/config.example.yml            |   4 +
 package.json                         |   1 +
 scripts/test-ssr-cache-stats.js      | 110 ++++++++++++++++++++++
 server.ts                            |  38 +++++++-
 src/backend/ssr-cache-stats.ts       | 132 +++++++++++++++++++++++++++
 src/config/cache-config.interface.ts |   3 +
 src/config/default-app-config.ts     |   2 +
 8 files changed, 291 insertions(+), 2 deletions(-)
 create mode 100644 scripts/test-ssr-cache-stats.js
 create mode 100644 src/backend/ssr-cache-stats.ts

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 241987b0f12..68a70123e74 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -83,6 +83,9 @@ jobs:
       - name: Run lint
         run: yarn run lint --quiet
 
+      - name: Run SSR cache stats tests
+        run: yarn run test:ssr-cache-stats
+
       - name: Check for circular dependencies
         run: yarn run check-circ-deps
 
diff --git a/config/config.example.yml b/config/config.example.yml
index 8b56711c7d2..56b27337721 100644
--- a/config/config.example.yml
+++ b/config/config.example.yml
@@ -97,6 +97,10 @@ cache:
   serverSide:
     # Set to true to see all cache hits/misses/refreshes in your console logs. Useful for debugging SSR caching issues.
     debug: false
+    # Set to a port number (e.g. 4001) to expose the contents of the caches below to operators on this machine only:
+    # GET http://127.0.0.1:<port>/app/cache-stats (HTML) or ?format=json. Each Node process reports its own cache;
+    # under pm2 cluster mode worker N listens on <port> + N. Default is zero (0), which disables the endpoint.
+    statsPort: 0
     # When enabled (i.e. max > 0), known bots will be sent pages from a server side cache specific for bots.
     # (Keep in mind, bot detection cannot be guarranteed. It is possible some bots will bypass this cache.)
     botCache:
diff --git a/package.json b/package.json
index 565c0510999..34a3f54fb5e 100644
--- a/package.json
+++ b/package.json
@@ -5,6 +5,7 @@
     "ng": "ng",
     "config:watch": "nodemon",
     "test:rest": "ts-node --project ./tsconfig.ts-node.json scripts/test-rest.ts",
+    "test:ssr-cache-stats": "node --test scripts/test-ssr-cache-stats.js",
     "start": "yarn run start:prod",
     "start:dev": "nodemon --exec \"cross-env NODE_ENV=development yarn run serve\"",
     "start:prod": "yarn run build:prod && cross-env NODE_ENV=production yarn run serve:ssr",
diff --git a/scripts/test-ssr-cache-stats.js b/scripts/test-ssr-cache-stats.js
new file mode 100644
index 00000000000..ca76b71d43c
--- /dev/null
+++ b/scripts/test-ssr-cache-stats.js
@@ -0,0 +1,110 @@
+const assert = require('node:assert/strict');
+const { once } = require('node:events');
+const { connect } = require('node:net');
+const { test } = require('node:test');
+const { setTimeout: sleep } = require('node:timers/promises');
+const LRU = require('lru-cache');
+
+process.env.TS_NODE_PROJECT = 'tsconfig.ts-node.json';
+require('ts-node/register/transpile-only');
+const { snapshotCache, renderStatsHtml, startSsrCacheStatsServer } = require('../src/backend/ssr-cache-stats.ts');
+
+const statsOf = (caches) => ({
+  host: 'node-1', pid: 1, instance: 0, generatedAt: 'now', uptimeSeconds: 2,
+  memory: { rss: 1, heapUsed: 1 }, caches
+});
+
+test('snapshot reports entries, HTML byte sizes and TTL without changing LRU order', () => {
+  const cache = new LRU({ max: 3, ttl: 60000 });
+  cache.set('/small', { page: 'é', headers: { 'content-type': 'text/html' } });
+  cache.set('/large', { page: 'larger', headers: {} });
+  const before = [...cache.keys()];
+
+  const stats = snapshotCache('bot', cache, true);
+
+  assert.equal(stats.entryCount, 2);
+  assert.equal(stats.totalHtmlBytes, 8);
+  assert.deepEqual(stats.entries.map(e => e.key), ['/large', '/small']);
+  assert.equal(stats.maxEntries, 3);
+  assert.equal(stats.configuredTtlMs, 60000);
+  assert.equal(stats.entries[0].remainingTtlMs > 0, true);
+  assert.equal(stats.entries[0].stale, false);
+  assert.deepEqual([...cache.keys()], before);
+});
+
+test('snapshot counts expired entries even when the cache does not serve stale pages', async () => {
+  const cache = new LRU({ max: 2, ttl: 1, allowStale: false });
+  cache.set('/expired', { page: 'x' });
+  await sleep(5);
+  assert.equal(cache.size, 1);
+
+  const stats = snapshotCache('anonymous', cache, true);
+
+  assert.equal(stats.entryCount, 1);
+  assert.equal(stats.staleCount, 1);
+  assert.deepEqual(stats.entries[0], { key: '/expired', htmlBytes: 1, remainingTtlMs: 0, stale: true });
+  assert.equal(cache.size, 1);
+});
+
+test('snapshot of a missing cache and of a cache without TTL', () => {
+  assert.deepEqual(snapshotCache('bot', undefined, false), {
+    name: 'bot', enabled: false, maxEntries: 0, configuredTtlMs: 0, entryCount: 0, staleCount: 0, totalHtmlBytes: 0, entries: []
+  });
+  const cache = new LRU({ max: 1 });
+  cache.set('/forever', { page: 'x' });
+  assert.equal(snapshotCache('bot', cache, true).entries[0].remainingTtlMs, null);
+});
+
+test('stats HTML escapes cache paths', () => {
+  const cache = new LRU({ max: 2 });
+  cache.set('/<script>alert(1)</script>', { page: 'x' });
+  const html = renderStatsHtml(statsOf([snapshotCache('bot', cache, true)]));
+  assert.match(html, /SSR cache stats/);
+  assert.equal(html.includes('<script>'), false);
+  assert.match(html, /&lt;script&gt;/);
+});
+
+test('stats server listens on loopback and answers only GET /app/cache-stats', async () => {
+  const payload = statsOf([]);
+  const server = startSsrCacheStatsServer(0, () => payload);
+  try {
+    await once(server, 'listening');
+    const address = server.address();
+    assert.equal(address.address, '127.0.0.1');
+    const base = `http://127.0.0.1:${address.port}`;
+
+    const json = await fetch(`${base}/app/cache-stats?format=json`);
+    assert.equal(json.status, 200);
+    assert.equal(json.headers.get('cache-control'), 'no-store');
+    assert.deepEqual(await json.json(), payload);
+
+    const html = await fetch(`${base}/app/cache-stats`);
+    assert.equal(html.status, 200);
+    assert.match(html.headers.get('content-type'), /^text\/html/);
+
+    assert.equal((await fetch(`${base}/other`)).status, 404);
+    assert.equal((await fetch(`${base}/app/cache-stats`, { method: 'POST' })).status, 404);
+
+    const socket = connect(address.port, '127.0.0.1');
+    await once(socket, 'connect');
+    socket.end('GET //[ HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n');
+    const chunks = [];
+    socket.on('data', chunk => chunks.push(chunk));
+    await once(socket, 'close');
+    assert.match(Buffer.concat(chunks).toString(), /^HTTP\/1\.1 400 /);
+  } finally {
+    await new Promise((resolve, reject) => server.close(error => error ? reject(error) : resolve()));
+  }
+});
+
+test('stats server reports a failed bind on its error event instead of throwing', async () => {
+  const blocker = startSsrCacheStatsServer(0, () => statsOf([]));
+  await once(blocker, 'listening');
+  try {
+    const clash = startSsrCacheStatsServer(blocker.address().port, () => statsOf([]));
+    const [error] = await once(clash, 'error');
+    assert.equal(error.code, 'EADDRINUSE');
+  } finally {
+    await new Promise((resolve) => blocker.close(resolve));
+  }
+});
diff --git a/server.ts b/server.ts
index e7b13aef522..a03dabf628f 100644
--- a/server.ts
+++ b/server.ts
@@ -36,6 +36,7 @@ import { createHttpTerminator } from 'http-terminator';
 
 import { readFileSync } from 'fs';
 import { join } from 'path';
+import { hostname } from 'os';
 
 import { enableProdMode } from '@angular/core';
 
@@ -56,6 +57,7 @@ import { extendEnvironmentWithAppConfig } from './src/config/config.util';
 import { logStartupMessage } from './startup-message';
 import { TOKENITEM } from './src/app/core/auth/models/auth-token-info.model';
 import { SsrExcludePatterns } from './src/config/universal-config.interface';
+import { SSR_CACHE_STATS_PATH, SsrCacheEntry, snapshotCache, startSsrCacheStatsServer } from './src/backend/ssr-cache-stats';
 
 
 /*
@@ -72,10 +74,10 @@ const cookieParser = require('cookie-parser');
 const appConfig: AppConfig = buildAppConfig(join(DIST_FOLDER, 'assets/config.json'));
 
 // cache of SSR pages for known bots, only enabled in production mode
-let botCache: LRU<string, any>;
+let botCache: LRU<string, SsrCacheEntry>;
 
 // cache of SSR pages for anonymous users. Disabled by default, and only available in production mode
-let anonymousCache: LRU<string, any>;
+let anonymousCache: LRU<string, SsrCacheEntry>;
 
 // extend environment with app config for server
 extendEnvironmentWithAppConfig(environment, appConfig);
@@ -592,9 +594,41 @@ function run() {
       });
 }
 
+/**
+ * Expose the contents of this process's SSR caches on 127.0.0.1 for operators.
+ * Under pm2 cluster mode every worker gets its own port (basePort + NODE_APP_INSTANCE), because a shared
+ * port would be answered by an arbitrary worker. A failed bind is logged and never stops the UI.
+ */
+function startCacheStatsServer(basePort: number) {
+  const instance = Number(process.env.NODE_APP_INSTANCE) || 0;
+  const port = basePort + instance;
+  const statsServer = startSsrCacheStatsServer(port, () => {
+    const memory = process.memoryUsage();
+    return {
+      host: hostname(),
+      pid: process.pid,
+      instance,
+      generatedAt: new Date().toISOString(),
+      uptimeSeconds: Math.round(process.uptime()),
+      memory: { rss: memory.rss, heapUsed: memory.heapUsed },
+      caches: [
+        snapshotCache('bot', botCache, environment.production && botCacheEnabled()),
+        snapshotCache('anonymous', anonymousCache, environment.production && anonymousCacheEnabled())
+      ]
+    };
+  });
+  statsServer.on('listening', () => console.log(`SSR cache stats listening at http://127.0.0.1:${port}${SSR_CACHE_STATS_PATH}`));
+  statsServer.on('error', (e: Error) => console.error(`SSR cache stats server not started on port ${port}: ${e.message}`));
+  process.on('SIGINT', () => statsServer.close());
+}
+
 function start() {
   logStartupMessage(environment);
 
+  if (environment.cache.serverSide.statsPort > 0) {
+    startCacheStatsServer(environment.cache.serverSide.statsPort);
+  }
+
   /*
   * If SSL is enabled
   * - Read credentials from configuration files
diff --git a/src/backend/ssr-cache-stats.ts b/src/backend/ssr-cache-stats.ts
new file mode 100644
index 00000000000..655b944604f
--- /dev/null
+++ b/src/backend/ssr-cache-stats.ts
@@ -0,0 +1,132 @@
+import { createServer } from 'http';
+import LRU from 'lru-cache';
+
+export interface SsrCacheEntry {
+  page: string;
+  headers?: Record<string, unknown>;
+}
+
+export interface SsrCacheEntryStats {
+  key: string;
+  htmlBytes: number;
+  remainingTtlMs: number | null;
+  stale: boolean;
+}
+
+export interface SsrCacheSnapshot {
+  name: string;
+  enabled: boolean;
+  maxEntries: number;
+  configuredTtlMs: number;
+  entryCount: number;
+  staleCount: number;
+  totalHtmlBytes: number;
+  entries: SsrCacheEntryStats[];
+}
+
+export interface SsrCacheStats {
+  host: string;
+  pid: number;
+  instance: number;
+  generatedAt: string;
+  uptimeSeconds: number;
+  memory: {
+    rss: number;
+    heapUsed: number;
+  };
+  caches: SsrCacheSnapshot[];
+}
+
+export const SSR_CACHE_STATS_PATH = '/app/cache-stats';
+
+/**
+ * Describe every entry resident in an SSR page cache, largest page first.
+ * `dump()` visits stale entries too (unlike `forEach`, which skips them when `allowStale` is false);
+ * `dump()`, `peek()` and `has()` leave recency and TTL untouched. Byte counting is O(total cached HTML).
+ */
+export function snapshotCache(name: string, cache: LRU<string, SsrCacheEntry> | undefined, enabled: boolean): SsrCacheSnapshot {
+  const entries: SsrCacheEntryStats[] = [];
+  if (cache) {
+    for (const [key, { value }] of cache.dump()) {
+      const remainingTtl = cache.getRemainingTTL(key);
+      entries.push({
+        key,
+        htmlBytes: Buffer.byteLength(value.page, 'utf8'),
+        remainingTtlMs: Number.isFinite(remainingTtl) ? Math.max(0, Math.round(remainingTtl)) : null,
+        stale: !cache.has(key)
+      });
+    }
+  }
+  entries.sort((a, b) => b.htmlBytes - a.htmlBytes || a.key.localeCompare(b.key));
+  return {
+    name,
+    enabled,
+    maxEntries: cache ? cache.max : 0,
+    configuredTtlMs: cache ? cache.ttl : 0,
+    entryCount: entries.length,
+    staleCount: entries.filter(entry => entry.stale).length,
+    totalHtmlBytes: entries.reduce((sum, entry) => sum + entry.htmlBytes, 0),
+    entries
+  };
+}
+
+function escapeHtml(value: string): string {
+  return value.replace(/[&<>"']/g, character => ({
+    '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'
+  })[character]);
+}
+
+export function renderStatsHtml(stats: SsrCacheStats): string {
+  const summary = stats.caches.map(cache =>
+    `<tr><th>${escapeHtml(cache.name)}</th><td>${cache.enabled}</td><td>${cache.entryCount} / ${cache.maxEntries}</td>` +
+    `<td>${cache.staleCount}</td><td>${cache.totalHtmlBytes}</td></tr>`
+  ).join('');
+  const details = stats.caches.map(cache =>
+    `<h2>${escapeHtml(cache.name)} entries</h2><p>Configured TTL: ${cache.configuredTtlMs} ms. ` +
+    'HTML byte counts exclude object and V8 overhead.</p>' +
+    '<table border="1"><thead><tr><th>Path</th><th>HTML bytes</th><th>Remaining TTL (ms)</th><th>Stale</th></tr></thead><tbody>' +
+    cache.entries.map(entry =>
+      `<tr><td>${escapeHtml(entry.key)}</td><td>${entry.htmlBytes}</td>` +
+      `<td>${entry.remainingTtlMs === null ? 'unlimited' : entry.remainingTtlMs}</td><td>${entry.stale}</td></tr>`
+    ).join('') + '</tbody></table>'
+  ).join('');
+  return '<!doctype html><html lang="en"><meta charset="utf-8"><title>SSR cache stats</title><h1>SSR cache stats</h1>' +
+    `<p>Node: ${escapeHtml(stats.host)}; PID: ${stats.pid}; instance: ${stats.instance}; generated: ${escapeHtml(stats.generatedAt)}; ` +
+    `uptime: ${stats.uptimeSeconds} s; RSS: ${stats.memory.rss} bytes; heap used: ${stats.memory.heapUsed} bytes.</p>` +
+    '<p>Each Node process has its own cache; this page reports this process only. <a href="?format=json">JSON</a></p>' +
+    '<table border="1"><thead><tr><th>Cache</th><th>Enabled</th><th>Entries / limit</th><th>Stale</th><th>HTML bytes</th></tr></thead>' +
+    `<tbody>${summary}</tbody></table>${details}</html>`;
+}
+
+/**
+ * Serve the cache stats on 127.0.0.1:port (0 = ephemeral). Only GET /app/cache-stats answers; `?format=json` for JSON.
+ * The request handler never throws; a failed bind surfaces on the returned server's 'error' event.
+ */
+export function startSsrCacheStatsServer(port: number, getStats: () => SsrCacheStats): ReturnType<typeof createServer> {
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new Error('SSR cache stats port must be an integer from 0 to 65535');
+  }
+  const server = createServer((request, response) => {
+    response.setHeader('Cache-Control', 'no-store');
+    response.setHeader('X-Content-Type-Options', 'nosniff');
+    response.setHeader('Content-Security-Policy', "default-src 'none'; base-uri 'none'; frame-ancestors 'none'");
+    let url: URL;
+    try {
+      url = new URL(request.url || '/', 'http://localhost');
+    } catch {
+      response.writeHead(400).end();
+      return;
+    }
+    if (request.method !== 'GET' || url.pathname !== SSR_CACHE_STATS_PATH) {
+      response.writeHead(404).end();
+      return;
+    }
+    const stats = getStats();
+    if (url.searchParams.get('format') === 'json') {
+      response.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' }).end(JSON.stringify(stats));
+    } else {
+      response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' }).end(renderStatsHtml(stats));
+    }
+  });
+  return server.listen(port, '127.0.0.1');
+}
diff --git a/src/config/cache-config.interface.ts b/src/config/cache-config.interface.ts
index 73520c95ea1..99bc647c776 100644
--- a/src/config/cache-config.interface.ts
+++ b/src/config/cache-config.interface.ts
@@ -15,6 +15,9 @@ export interface CacheConfig extends Config {
     debug: boolean,
     // List of response headers to save into the cache
     headers: string[],
+    // Loopback-only HTTP port reporting the contents of the caches below (GET http://127.0.0.1:<port>/app/cache-stats).
+    // 0 disables it. Under pm2 cluster mode each worker listens on statsPort + NODE_APP_INSTANCE.
+    statsPort: number,
     // Cache specific to known bots.  Allows you to serve cached contents to bots only.
     botCache: {
       // Maximum number of pages (rendered via SSR) to cache. Setting max=0 disables the cache.
diff --git a/src/config/default-app-config.ts b/src/config/default-app-config.ts
index 38cb942e457..99ab0ccb0d2 100644
--- a/src/config/default-app-config.ts
+++ b/src/config/default-app-config.ts
@@ -84,6 +84,8 @@ export class DefaultAppConfig implements AppConfig {
       debug: false,
       // Link header is used for signposting functionality
       headers: ['Link'],
+      // Loopback-only cache stats endpoint; 0 = disabled
+      statsPort: 0,
       // Cache specific to known bots.  Allows you to serve cached contents to bots only.
       // Defaults to caching 1,000 pages. Each page expires after 1 day
       botCache: {

From cb233fafb128bf453b7eedb80ffafec03d5a9b75 Mon Sep 17 00:00:00 2001
From: jm <jm@maz>
Date: Thu, 22 Oct 2026 18:29:06 +0200
Subject: [PATCH 2/7] feat(ssr): let cache stats be served on the UI port or on
 a port of their own

cache.serverSide.stats { enabled, port } replaces statsPort. port 0 serves
/app/cache-stats from the Express app, but only to loopback socket
addresses (req.socket.remoteAddress, not the proxy-trusting req.ip); a
port number keeps the separate 127.0.0.1 listener with the per-worker
offset. The request handler is shared by both paths.
---
 config/config.example.yml            | 12 +++--
 scripts/test-ssr-cache-stats.js      | 42 +++++++++++++----
 server.ts                            | 68 ++++++++++++++++++----------
 src/backend/ssr-cache-stats.ts       | 40 ++++++++++++----
 src/config/cache-config.interface.ts | 10 ++--
 src/config/default-app-config.ts     |  7 ++-
 6 files changed, 130 insertions(+), 49 deletions(-)

diff --git a/config/config.example.yml b/config/config.example.yml
index 56b27337721..e636aacc45b 100644
--- a/config/config.example.yml
+++ b/config/config.example.yml
@@ -97,10 +97,14 @@ cache:
   serverSide:
     # Set to true to see all cache hits/misses/refreshes in your console logs. Useful for debugging SSR caching issues.
     debug: false
-    # Set to a port number (e.g. 4001) to expose the contents of the caches below to operators on this machine only:
-    # GET http://127.0.0.1:<port>/app/cache-stats (HTML) or ?format=json. Each Node process reports its own cache;
-    # under pm2 cluster mode worker N listens on <port> + N. Default is zero (0), which disables the endpoint.
-    statsPort: 0
+    # Lets operators on this machine see what the caches below hold: GET /app/cache-stats (HTML) or ?format=json.
+    # Each Node process reports its own cache. Off by default.
+    stats:
+      enabled: false
+      # 0 = answer on the UI port, but only to clients connecting from 127.0.0.1 (everyone else gets 404).
+      # A port number (e.g. 4001) = listen on 127.0.0.1:<port> instead; under pm2 cluster mode worker N uses <port> + N,
+      # which is the only way to pick a specific worker.
+      port: 0
     # When enabled (i.e. max > 0), known bots will be sent pages from a server side cache specific for bots.
     # (Keep in mind, bot detection cannot be guarranteed. It is possible some bots will bypass this cache.)
     botCache:
diff --git a/scripts/test-ssr-cache-stats.js b/scripts/test-ssr-cache-stats.js
index ca76b71d43c..9a5a1b90e48 100644
--- a/scripts/test-ssr-cache-stats.js
+++ b/scripts/test-ssr-cache-stats.js
@@ -1,5 +1,6 @@
 const assert = require('node:assert/strict');
 const { once } = require('node:events');
+const { createServer } = require('node:http');
 const { connect } = require('node:net');
 const { test } = require('node:test');
 const { setTimeout: sleep } = require('node:timers/promises');
@@ -7,7 +8,19 @@ const LRU = require('lru-cache');
 
 process.env.TS_NODE_PROJECT = 'tsconfig.ts-node.json';
 require('ts-node/register/transpile-only');
-const { snapshotCache, renderStatsHtml, startSsrCacheStatsServer } = require('../src/backend/ssr-cache-stats.ts');
+const {
+  snapshotCache, renderStatsHtml, startSsrCacheStatsServer, createSsrCacheStatsHandler, isLoopbackAddress
+} = require('../src/backend/ssr-cache-stats.ts');
+
+const rawRequest = async (port, requestLine) => {
+  const socket = connect(port, '127.0.0.1');
+  await once(socket, 'connect');
+  socket.end(`${requestLine}\r\nHost: x\r\nConnection: close\r\n\r\n`);
+  const chunks = [];
+  socket.on('data', chunk => chunks.push(chunk));
+  await once(socket, 'close');
+  return Buffer.concat(chunks).toString();
+};
 
 const statsOf = (caches) => ({
   host: 'node-1', pid: 1, instance: 0, generatedAt: 'now', uptimeSeconds: 2,
@@ -85,18 +98,31 @@ test('stats server listens on loopback and answers only GET /app/cache-stats', a
     assert.equal((await fetch(`${base}/other`)).status, 404);
     assert.equal((await fetch(`${base}/app/cache-stats`, { method: 'POST' })).status, 404);
 
-    const socket = connect(address.port, '127.0.0.1');
-    await once(socket, 'connect');
-    socket.end('GET //[ HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n');
-    const chunks = [];
-    socket.on('data', chunk => chunks.push(chunk));
-    await once(socket, 'close');
-    assert.match(Buffer.concat(chunks).toString(), /^HTTP\/1\.1 400 /);
+    assert.equal((await rawRequest(address.port, 'GET //[ HTTP/1.1')).split(' ')[1], '404');
   } finally {
     await new Promise((resolve, reject) => server.close(error => error ? reject(error) : resolve()));
   }
 });
 
+test('handler answers an unparsable request target with 400 instead of throwing', async () => {
+  const server = createServer(createSsrCacheStatsHandler(() => statsOf([]))).listen(0, '127.0.0.1');
+  try {
+    await once(server, 'listening');
+    assert.equal((await rawRequest(server.address().port, 'GET //[ HTTP/1.1')).split(' ')[1], '400');
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+});
+
+test('loopback check accepts only local socket addresses', () => {
+  for (const address of ['127.0.0.1', '::1', '::ffff:127.0.0.1']) {
+    assert.equal(isLoopbackAddress(address), true, address);
+  }
+  for (const address of ['10.0.0.5', '::ffff:10.0.0.5', '0.0.0.0', '', undefined]) {
+    assert.equal(isLoopbackAddress(address), false, String(address));
+  }
+});
+
 test('stats server reports a failed bind on its error event instead of throwing', async () => {
   const blocker = startSsrCacheStatsServer(0, () => statsOf([]));
   await once(blocker, 'listening');
diff --git a/server.ts b/server.ts
index a03dabf628f..e5e72139759 100644
--- a/server.ts
+++ b/server.ts
@@ -57,7 +57,15 @@ import { extendEnvironmentWithAppConfig } from './src/config/config.util';
 import { logStartupMessage } from './startup-message';
 import { TOKENITEM } from './src/app/core/auth/models/auth-token-info.model';
 import { SsrExcludePatterns } from './src/config/universal-config.interface';
-import { SSR_CACHE_STATS_PATH, SsrCacheEntry, snapshotCache, startSsrCacheStatsServer } from './src/backend/ssr-cache-stats';
+import {
+  createSsrCacheStatsHandler,
+  isLoopbackAddress,
+  snapshotCache,
+  SSR_CACHE_STATS_PATH,
+  SsrCacheEntry,
+  SsrCacheStats,
+  startSsrCacheStatsServer
+} from './src/backend/ssr-cache-stats';
 
 
 /*
@@ -231,6 +239,16 @@ export function app() {
    */
   server.get('/app/health', healthCheck);
 
+  /**
+   * SSR cache contents for operators on this host (see cache.serverSide.stats). With stats.port = 0 the page is
+   * served here, but only to loopback clients: the raw socket address is checked, not req.ip, which honours
+   * X-Forwarded-For when `trust proxy` is on. Other clients get the same 404 as an unknown route.
+   */
+  if (environment.cache.serverSide.stats.enabled && environment.cache.serverSide.stats.port === 0) {
+    const statsHandler = createSsrCacheStatsHandler(collectCacheStats);
+    server.get(SSR_CACHE_STATS_PATH, (req, res) => isLoopbackAddress(req.socket.remoteAddress) ? statsHandler(req, res) : res.sendStatus(404));
+  }
+
   /**
    * Default sending all incoming requests to ngApp() function, after first checking for a cached
    * copy of the page (see cacheCheck())
@@ -594,29 +612,33 @@ function run() {
       });
 }
 
+/** pm2 cluster mode numbers its workers 0..n-1 in NODE_APP_INSTANCE; a single process reports 0. */
+const CLUSTER_INSTANCE = Number(process.env.NODE_APP_INSTANCE) || 0;
+
+function collectCacheStats(): SsrCacheStats {
+  const memory = process.memoryUsage();
+  return {
+    host: hostname(),
+    pid: process.pid,
+    instance: CLUSTER_INSTANCE,
+    generatedAt: new Date().toISOString(),
+    uptimeSeconds: Math.round(process.uptime()),
+    memory: { rss: memory.rss, heapUsed: memory.heapUsed },
+    caches: [
+      snapshotCache('bot', botCache, environment.production && botCacheEnabled()),
+      snapshotCache('anonymous', anonymousCache, environment.production && anonymousCacheEnabled())
+    ]
+  };
+}
+
 /**
- * Expose the contents of this process's SSR caches on 127.0.0.1 for operators.
- * Under pm2 cluster mode every worker gets its own port (basePort + NODE_APP_INSTANCE), because a shared
- * port would be answered by an arbitrary worker. A failed bind is logged and never stops the UI.
+ * Serve the cache stats on a loopback-only port of their own. Every pm2 cluster worker gets basePort + its
+ * instance number, because a port shared by the workers would be answered by an arbitrary one.
+ * A failed bind is logged and never stops the UI.
  */
 function startCacheStatsServer(basePort: number) {
-  const instance = Number(process.env.NODE_APP_INSTANCE) || 0;
-  const port = basePort + instance;
-  const statsServer = startSsrCacheStatsServer(port, () => {
-    const memory = process.memoryUsage();
-    return {
-      host: hostname(),
-      pid: process.pid,
-      instance,
-      generatedAt: new Date().toISOString(),
-      uptimeSeconds: Math.round(process.uptime()),
-      memory: { rss: memory.rss, heapUsed: memory.heapUsed },
-      caches: [
-        snapshotCache('bot', botCache, environment.production && botCacheEnabled()),
-        snapshotCache('anonymous', anonymousCache, environment.production && anonymousCacheEnabled())
-      ]
-    };
-  });
+  const port = basePort + CLUSTER_INSTANCE;
+  const statsServer = startSsrCacheStatsServer(port, collectCacheStats);
   statsServer.on('listening', () => console.log(`SSR cache stats listening at http://127.0.0.1:${port}${SSR_CACHE_STATS_PATH}`));
   statsServer.on('error', (e: Error) => console.error(`SSR cache stats server not started on port ${port}: ${e.message}`));
   process.on('SIGINT', () => statsServer.close());
@@ -625,8 +647,8 @@ function startCacheStatsServer(basePort: number) {
 function start() {
   logStartupMessage(environment);
 
-  if (environment.cache.serverSide.statsPort > 0) {
-    startCacheStatsServer(environment.cache.serverSide.statsPort);
+  if (environment.cache.serverSide.stats.enabled && environment.cache.serverSide.stats.port > 0) {
+    startCacheStatsServer(environment.cache.serverSide.stats.port);
   }
 
   /*
diff --git a/src/backend/ssr-cache-stats.ts b/src/backend/ssr-cache-stats.ts
index 655b944604f..a8f2bf10466 100644
--- a/src/backend/ssr-cache-stats.ts
+++ b/src/backend/ssr-cache-stats.ts
@@ -1,4 +1,4 @@
-import { createServer } from 'http';
+import { createServer, IncomingMessage, ServerResponse } from 'http';
 import LRU from 'lru-cache';
 
 export interface SsrCacheEntry {
@@ -98,15 +98,19 @@ export function renderStatsHtml(stats: SsrCacheStats): string {
     `<tbody>${summary}</tbody></table>${details}</html>`;
 }
 
+const LOOPBACK_ADDRESSES = ['127.0.0.1', '::1', '::ffff:127.0.0.1'];
+
+/** True for a socket address on the local host; used to keep the stats off the public UI port. */
+export function isLoopbackAddress(address: string | undefined): boolean {
+  return address !== undefined && LOOPBACK_ADDRESSES.includes(address);
+}
+
 /**
- * Serve the cache stats on 127.0.0.1:port (0 = ephemeral). Only GET /app/cache-stats answers; `?format=json` for JSON.
- * The request handler never throws; a failed bind surfaces on the returned server's 'error' event.
+ * Request handler answering GET with the stats as HTML, or as JSON for `?format=json`; any other method gets 404
+ * and an unparsable request target 400. It never throws, so it is safe on a bare `http` server.
  */
-export function startSsrCacheStatsServer(port: number, getStats: () => SsrCacheStats): ReturnType<typeof createServer> {
-  if (!Number.isInteger(port) || port < 0 || port > 65535) {
-    throw new Error('SSR cache stats port must be an integer from 0 to 65535');
-  }
-  const server = createServer((request, response) => {
+export function createSsrCacheStatsHandler(getStats: () => SsrCacheStats): (request: IncomingMessage, response: ServerResponse) => void {
+  return (request, response) => {
     response.setHeader('Cache-Control', 'no-store');
     response.setHeader('X-Content-Type-Options', 'nosniff');
     response.setHeader('Content-Security-Policy', "default-src 'none'; base-uri 'none'; frame-ancestors 'none'");
@@ -117,7 +121,7 @@ export function startSsrCacheStatsServer(port: number, getStats: () => SsrCacheS
       response.writeHead(400).end();
       return;
     }
-    if (request.method !== 'GET' || url.pathname !== SSR_CACHE_STATS_PATH) {
+    if (request.method !== 'GET') {
       response.writeHead(404).end();
       return;
     }
@@ -127,6 +131,24 @@ export function startSsrCacheStatsServer(port: number, getStats: () => SsrCacheS
     } else {
       response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' }).end(renderStatsHtml(stats));
     }
+  };
+}
+
+/**
+ * Serve the cache stats on 127.0.0.1:port (0 = ephemeral) under /app/cache-stats only.
+ * A failed bind surfaces on the returned server's 'error' event.
+ */
+export function startSsrCacheStatsServer(port: number, getStats: () => SsrCacheStats): ReturnType<typeof createServer> {
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new Error('SSR cache stats port must be an integer from 0 to 65535');
+  }
+  const handler = createSsrCacheStatsHandler(getStats);
+  const server = createServer((request, response) => {
+    if ((request.url || '/').split('?')[0] !== SSR_CACHE_STATS_PATH) {
+      response.writeHead(404).end();
+      return;
+    }
+    handler(request, response);
   });
   return server.listen(port, '127.0.0.1');
 }
diff --git a/src/config/cache-config.interface.ts b/src/config/cache-config.interface.ts
index 99bc647c776..56af7a83101 100644
--- a/src/config/cache-config.interface.ts
+++ b/src/config/cache-config.interface.ts
@@ -15,9 +15,13 @@ export interface CacheConfig extends Config {
     debug: boolean,
     // List of response headers to save into the cache
     headers: string[],
-    // Loopback-only HTTP port reporting the contents of the caches below (GET http://127.0.0.1:<port>/app/cache-stats).
-    // 0 disables it. Under pm2 cluster mode each worker listens on statsPort + NODE_APP_INSTANCE.
-    statsPort: number,
+    // Report the contents of the caches below to operators on this host: GET /app/cache-stats (HTML, or ?format=json)
+    stats: {
+      enabled: boolean,
+      // 0 = serve it on the UI port, loopback clients only. >0 = listen on 127.0.0.1:<port> instead;
+      // under pm2 cluster mode worker N listens on <port> + N, so each worker's own cache can be inspected.
+      port: number,
+    },
     // Cache specific to known bots.  Allows you to serve cached contents to bots only.
     botCache: {
       // Maximum number of pages (rendered via SSR) to cache. Setting max=0 disables the cache.
diff --git a/src/config/default-app-config.ts b/src/config/default-app-config.ts
index 99ab0ccb0d2..f53872e2f6b 100644
--- a/src/config/default-app-config.ts
+++ b/src/config/default-app-config.ts
@@ -84,8 +84,11 @@ export class DefaultAppConfig implements AppConfig {
       debug: false,
       // Link header is used for signposting functionality
       headers: ['Link'],
-      // Loopback-only cache stats endpoint; 0 = disabled
-      statsPort: 0,
+      // Cache stats endpoint for operators, off by default
+      stats: {
+        enabled: false,
+        port: 0,
+      },
       // Cache specific to known bots.  Allows you to serve cached contents to bots only.
       // Defaults to caching 1,000 pages. Each page expires after 1 day
       botCache: {

From 9c927321c3b936c158c08f7ac215ad58f1381b44 Mon Sep 17 00:00:00 2001
From: jm <jm@maz>
Date: Thu, 22 Oct 2026 20:55:07 +0200
Subject: [PATCH 3/7] fix(ssr): refuse proxied requests to the UI-port cache
 stats, add stats to the test env

A same-host reverse proxy connects from loopback, so the socket address
alone let public traffic through; requests carrying Forwarded, Via,
X-Forwarded-* or X-Real-IP are now refused as well. The required stats
key was missing from environment.test.ts and broke tsconfig.spec.json.
---
 config/config.example.yml            |  4 +++-
 scripts/test-ssr-cache-stats.js      | 13 +++++++++----
 server.ts                            |  9 +++++----
 src/backend/ssr-cache-stats.ts       | 14 +++++++++++---
 src/config/cache-config.interface.ts |  5 +++--
 src/environments/environment.test.ts |  4 ++++
 6 files changed, 35 insertions(+), 14 deletions(-)

diff --git a/config/config.example.yml b/config/config.example.yml
index e636aacc45b..f9b70fab471 100644
--- a/config/config.example.yml
+++ b/config/config.example.yml
@@ -101,7 +101,9 @@ cache:
     # Each Node process reports its own cache. Off by default.
     stats:
       enabled: false
-      # 0 = answer on the UI port, but only to clients connecting from 127.0.0.1 (everyone else gets 404).
+      # 0 = answer on the UI port, but only to requests made directly from this host: connecting from 127.0.0.1 and
+      # carrying no proxy headers (Forwarded, Via, X-Forwarded-*, X-Real-IP). Everyone else gets 404. A same-host reverse
+      # proxy that adds none of those headers would pass this check, so use a port number there.
       # A port number (e.g. 4001) = listen on 127.0.0.1:<port> instead; under pm2 cluster mode worker N uses <port> + N,
       # which is the only way to pick a specific worker.
       port: 0
diff --git a/scripts/test-ssr-cache-stats.js b/scripts/test-ssr-cache-stats.js
index 9a5a1b90e48..f5732636be1 100644
--- a/scripts/test-ssr-cache-stats.js
+++ b/scripts/test-ssr-cache-stats.js
@@ -9,7 +9,7 @@ const LRU = require('lru-cache');
 process.env.TS_NODE_PROJECT = 'tsconfig.ts-node.json';
 require('ts-node/register/transpile-only');
 const {
-  snapshotCache, renderStatsHtml, startSsrCacheStatsServer, createSsrCacheStatsHandler, isLoopbackAddress
+  snapshotCache, renderStatsHtml, startSsrCacheStatsServer, createSsrCacheStatsHandler, isDirectLoopbackRequest
 } = require('../src/backend/ssr-cache-stats.ts');
 
 const rawRequest = async (port, requestLine) => {
@@ -114,13 +114,18 @@ test('handler answers an unparsable request target with 400 instead of throwing'
   }
 });
 
-test('loopback check accepts only local socket addresses', () => {
+test('direct loopback check accepts local sockets without proxy headers only', () => {
+  const request = (remoteAddress, headers = {}) => ({ socket: { remoteAddress }, headers });
   for (const address of ['127.0.0.1', '::1', '::ffff:127.0.0.1']) {
-    assert.equal(isLoopbackAddress(address), true, address);
+    assert.equal(isDirectLoopbackRequest(request(address)), true, address);
   }
   for (const address of ['10.0.0.5', '::ffff:10.0.0.5', '0.0.0.0', '', undefined]) {
-    assert.equal(isLoopbackAddress(address), false, String(address));
+    assert.equal(isDirectLoopbackRequest(request(address)), false, String(address));
   }
+  for (const header of ['forwarded', 'via', 'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-real-ip']) {
+    assert.equal(isDirectLoopbackRequest(request('127.0.0.1', { [header]: '' })), false, header);
+  }
+  assert.equal(isDirectLoopbackRequest(request('127.0.0.1', { 'user-agent': 'curl' })), true);
 });
 
 test('stats server reports a failed bind on its error event instead of throwing', async () => {
diff --git a/server.ts b/server.ts
index e5e72139759..e2604be76b5 100644
--- a/server.ts
+++ b/server.ts
@@ -59,7 +59,7 @@ import { TOKENITEM } from './src/app/core/auth/models/auth-token-info.model';
 import { SsrExcludePatterns } from './src/config/universal-config.interface';
 import {
   createSsrCacheStatsHandler,
-  isLoopbackAddress,
+  isDirectLoopbackRequest,
   snapshotCache,
   SSR_CACHE_STATS_PATH,
   SsrCacheEntry,
@@ -241,12 +241,13 @@ export function app() {
 
   /**
    * SSR cache contents for operators on this host (see cache.serverSide.stats). With stats.port = 0 the page is
-   * served here, but only to loopback clients: the raw socket address is checked, not req.ip, which honours
-   * X-Forwarded-For when `trust proxy` is on. Other clients get the same 404 as an unknown route.
+   * served here, but only to requests made directly from this host: loopback socket address (not req.ip, which
+   * honours X-Forwarded-For when `trust proxy` is on) and no proxy headers, so traffic relayed by a same-host
+   * reverse proxy is refused too. Everyone else gets the same 404 as an unknown route.
    */
   if (environment.cache.serverSide.stats.enabled && environment.cache.serverSide.stats.port === 0) {
     const statsHandler = createSsrCacheStatsHandler(collectCacheStats);
-    server.get(SSR_CACHE_STATS_PATH, (req, res) => isLoopbackAddress(req.socket.remoteAddress) ? statsHandler(req, res) : res.sendStatus(404));
+    server.get(SSR_CACHE_STATS_PATH, (req, res) => isDirectLoopbackRequest(req) ? statsHandler(req, res) : res.sendStatus(404));
   }
 
   /**
diff --git a/src/backend/ssr-cache-stats.ts b/src/backend/ssr-cache-stats.ts
index a8f2bf10466..2e99622aadd 100644
--- a/src/backend/ssr-cache-stats.ts
+++ b/src/backend/ssr-cache-stats.ts
@@ -99,10 +99,18 @@ export function renderStatsHtml(stats: SsrCacheStats): string {
 }
 
 const LOOPBACK_ADDRESSES = ['127.0.0.1', '::1', '::ffff:127.0.0.1'];
+/** Headers a reverse proxy adds; a request carrying one came through the proxy even if its socket is loopback. */
+const PROXY_HEADERS = ['forwarded', 'via', 'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-real-ip'];
 
-/** True for a socket address on the local host; used to keep the stats off the public UI port. */
-export function isLoopbackAddress(address: string | undefined): boolean {
-  return address !== undefined && LOOPBACK_ADDRESSES.includes(address);
+/**
+ * True when the request was made directly on this host: loopback socket address and no proxy headers.
+ * A same-host reverse proxy also connects from loopback, so the socket address alone is not enough.
+ * A proxy that adds none of these headers cannot be told apart; use a separate port there instead.
+ */
+export function isDirectLoopbackRequest(request: IncomingMessage): boolean {
+  const address = request.socket.remoteAddress;
+  return address !== undefined && LOOPBACK_ADDRESSES.includes(address) &&
+    !PROXY_HEADERS.some(header => request.headers[header] !== undefined);
 }
 
 /**
diff --git a/src/config/cache-config.interface.ts b/src/config/cache-config.interface.ts
index 56af7a83101..e4ad92bb7c7 100644
--- a/src/config/cache-config.interface.ts
+++ b/src/config/cache-config.interface.ts
@@ -18,8 +18,9 @@ export interface CacheConfig extends Config {
     // Report the contents of the caches below to operators on this host: GET /app/cache-stats (HTML, or ?format=json)
     stats: {
       enabled: boolean,
-      // 0 = serve it on the UI port, loopback clients only. >0 = listen on 127.0.0.1:<port> instead;
-      // under pm2 cluster mode worker N listens on <port> + N, so each worker's own cache can be inspected.
+      // 0 = serve it on the UI port to requests made directly from this host (loopback socket, no proxy headers).
+      // >0 = listen on 127.0.0.1:<port> instead; under pm2 cluster mode worker N listens on <port> + N, so each
+      // worker's own cache can be inspected. Prefer a port when a same-host reverse proxy adds no X-Forwarded-* headers.
       port: number,
     },
     // Cache specific to known bots.  Allows you to serve cached contents to bots only.
diff --git a/src/environments/environment.test.ts b/src/environments/environment.test.ts
index a0cab16ef83..9cdb7df1359 100644
--- a/src/environments/environment.test.ts
+++ b/src/environments/environment.test.ts
@@ -84,6 +84,10 @@ export const environment: BuildConfig = {
     serverSide: {
       debug: false,
       headers: ['Link'],
+      stats: {
+        enabled: false,
+        port: 0,
+      },
       botCache: {
         max: 0,
         timeToLive: 24 * 60 * 60 * 1000, // 1 day

From 77756f2164a915bfbce640061e916d94a7472621 Mon Sep 17 00:00:00 2001
From: jm <jm@maz>
Date: Fri, 23 Oct 2026 00:19:06 +0200
Subject: [PATCH 4/7] refactor(ssr): cache stats endpoint returns JSON only

Drop the HTML view, the ?format query parameter and the headers and
URL parsing that existed only for it.
---
 config/config.example.yml            |  2 +-
 scripts/test-ssr-cache-stats.js      | 40 ++---------------------
 server.ts                            |  2 +-
 src/backend/ssr-cache-stats.ts       | 49 ++--------------------------
 src/config/cache-config.interface.ts |  2 +-
 5 files changed, 7 insertions(+), 88 deletions(-)

diff --git a/config/config.example.yml b/config/config.example.yml
index f9b70fab471..bfafb3a775e 100644
--- a/config/config.example.yml
+++ b/config/config.example.yml
@@ -97,7 +97,7 @@ cache:
   serverSide:
     # Set to true to see all cache hits/misses/refreshes in your console logs. Useful for debugging SSR caching issues.
     debug: false
-    # Lets operators on this machine see what the caches below hold: GET /app/cache-stats (HTML) or ?format=json.
+    # Lets operators on this machine see what the caches below hold: GET /app/cache-stats (JSON).
     # Each Node process reports its own cache. Off by default.
     stats:
       enabled: false
diff --git a/scripts/test-ssr-cache-stats.js b/scripts/test-ssr-cache-stats.js
index f5732636be1..441d608c4c5 100644
--- a/scripts/test-ssr-cache-stats.js
+++ b/scripts/test-ssr-cache-stats.js
@@ -1,7 +1,5 @@
 const assert = require('node:assert/strict');
 const { once } = require('node:events');
-const { createServer } = require('node:http');
-const { connect } = require('node:net');
 const { test } = require('node:test');
 const { setTimeout: sleep } = require('node:timers/promises');
 const LRU = require('lru-cache');
@@ -9,19 +7,9 @@ const LRU = require('lru-cache');
 process.env.TS_NODE_PROJECT = 'tsconfig.ts-node.json';
 require('ts-node/register/transpile-only');
 const {
-  snapshotCache, renderStatsHtml, startSsrCacheStatsServer, createSsrCacheStatsHandler, isDirectLoopbackRequest
+  snapshotCache, startSsrCacheStatsServer, isDirectLoopbackRequest
 } = require('../src/backend/ssr-cache-stats.ts');
 
-const rawRequest = async (port, requestLine) => {
-  const socket = connect(port, '127.0.0.1');
-  await once(socket, 'connect');
-  socket.end(`${requestLine}\r\nHost: x\r\nConnection: close\r\n\r\n`);
-  const chunks = [];
-  socket.on('data', chunk => chunks.push(chunk));
-  await once(socket, 'close');
-  return Buffer.concat(chunks).toString();
-};
-
 const statsOf = (caches) => ({
   host: 'node-1', pid: 1, instance: 0, generatedAt: 'now', uptimeSeconds: 2,
   memory: { rss: 1, heapUsed: 1 }, caches
@@ -68,15 +56,6 @@ test('snapshot of a missing cache and of a cache without TTL', () => {
   assert.equal(snapshotCache('bot', cache, true).entries[0].remainingTtlMs, null);
 });
 
-test('stats HTML escapes cache paths', () => {
-  const cache = new LRU({ max: 2 });
-  cache.set('/<script>alert(1)</script>', { page: 'x' });
-  const html = renderStatsHtml(statsOf([snapshotCache('bot', cache, true)]));
-  assert.match(html, /SSR cache stats/);
-  assert.equal(html.includes('<script>'), false);
-  assert.match(html, /&lt;script&gt;/);
-});
-
 test('stats server listens on loopback and answers only GET /app/cache-stats', async () => {
   const payload = statsOf([]);
   const server = startSsrCacheStatsServer(0, () => payload);
@@ -86,34 +65,19 @@ test('stats server listens on loopback and answers only GET /app/cache-stats', a
     assert.equal(address.address, '127.0.0.1');
     const base = `http://127.0.0.1:${address.port}`;
 
-    const json = await fetch(`${base}/app/cache-stats?format=json`);
+    const json = await fetch(`${base}/app/cache-stats`);
     assert.equal(json.status, 200);
     assert.equal(json.headers.get('cache-control'), 'no-store');
     assert.deepEqual(await json.json(), payload);
 
-    const html = await fetch(`${base}/app/cache-stats`);
-    assert.equal(html.status, 200);
-    assert.match(html.headers.get('content-type'), /^text\/html/);
-
     assert.equal((await fetch(`${base}/other`)).status, 404);
     assert.equal((await fetch(`${base}/app/cache-stats`, { method: 'POST' })).status, 404);
 
-    assert.equal((await rawRequest(address.port, 'GET //[ HTTP/1.1')).split(' ')[1], '404');
   } finally {
     await new Promise((resolve, reject) => server.close(error => error ? reject(error) : resolve()));
   }
 });
 
-test('handler answers an unparsable request target with 400 instead of throwing', async () => {
-  const server = createServer(createSsrCacheStatsHandler(() => statsOf([]))).listen(0, '127.0.0.1');
-  try {
-    await once(server, 'listening');
-    assert.equal((await rawRequest(server.address().port, 'GET //[ HTTP/1.1')).split(' ')[1], '400');
-  } finally {
-    await new Promise((resolve) => server.close(resolve));
-  }
-});
-
 test('direct loopback check accepts local sockets without proxy headers only', () => {
   const request = (remoteAddress, headers = {}) => ({ socket: { remoteAddress }, headers });
   for (const address of ['127.0.0.1', '::1', '::ffff:127.0.0.1']) {
diff --git a/server.ts b/server.ts
index e2604be76b5..bff09d8a581 100644
--- a/server.ts
+++ b/server.ts
@@ -240,7 +240,7 @@ export function app() {
   server.get('/app/health', healthCheck);
 
   /**
-   * SSR cache contents for operators on this host (see cache.serverSide.stats). With stats.port = 0 the page is
+   * SSR cache contents for operators on this host (see cache.serverSide.stats). With stats.port = 0 they are
    * served here, but only to requests made directly from this host: loopback socket address (not req.ip, which
    * honours X-Forwarded-For when `trust proxy` is on) and no proxy headers, so traffic relayed by a same-host
    * reverse proxy is refused too. Everyone else gets the same 404 as an unknown route.
diff --git a/src/backend/ssr-cache-stats.ts b/src/backend/ssr-cache-stats.ts
index 2e99622aadd..7ee11bbc57a 100644
--- a/src/backend/ssr-cache-stats.ts
+++ b/src/backend/ssr-cache-stats.ts
@@ -70,34 +70,6 @@ export function snapshotCache(name: string, cache: LRU<string, SsrCacheEntry> |
   };
 }
 
-function escapeHtml(value: string): string {
-  return value.replace(/[&<>"']/g, character => ({
-    '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'
-  })[character]);
-}
-
-export function renderStatsHtml(stats: SsrCacheStats): string {
-  const summary = stats.caches.map(cache =>
-    `<tr><th>${escapeHtml(cache.name)}</th><td>${cache.enabled}</td><td>${cache.entryCount} / ${cache.maxEntries}</td>` +
-    `<td>${cache.staleCount}</td><td>${cache.totalHtmlBytes}</td></tr>`
-  ).join('');
-  const details = stats.caches.map(cache =>
-    `<h2>${escapeHtml(cache.name)} entries</h2><p>Configured TTL: ${cache.configuredTtlMs} ms. ` +
-    'HTML byte counts exclude object and V8 overhead.</p>' +
-    '<table border="1"><thead><tr><th>Path</th><th>HTML bytes</th><th>Remaining TTL (ms)</th><th>Stale</th></tr></thead><tbody>' +
-    cache.entries.map(entry =>
-      `<tr><td>${escapeHtml(entry.key)}</td><td>${entry.htmlBytes}</td>` +
-      `<td>${entry.remainingTtlMs === null ? 'unlimited' : entry.remainingTtlMs}</td><td>${entry.stale}</td></tr>`
-    ).join('') + '</tbody></table>'
-  ).join('');
-  return '<!doctype html><html lang="en"><meta charset="utf-8"><title>SSR cache stats</title><h1>SSR cache stats</h1>' +
-    `<p>Node: ${escapeHtml(stats.host)}; PID: ${stats.pid}; instance: ${stats.instance}; generated: ${escapeHtml(stats.generatedAt)}; ` +
-    `uptime: ${stats.uptimeSeconds} s; RSS: ${stats.memory.rss} bytes; heap used: ${stats.memory.heapUsed} bytes.</p>` +
-    '<p>Each Node process has its own cache; this page reports this process only. <a href="?format=json">JSON</a></p>' +
-    '<table border="1"><thead><tr><th>Cache</th><th>Enabled</th><th>Entries / limit</th><th>Stale</th><th>HTML bytes</th></tr></thead>' +
-    `<tbody>${summary}</tbody></table>${details}</html>`;
-}
-
 const LOOPBACK_ADDRESSES = ['127.0.0.1', '::1', '::ffff:127.0.0.1'];
 /** Headers a reverse proxy adds; a request carrying one came through the proxy even if its socket is loopback. */
 const PROXY_HEADERS = ['forwarded', 'via', 'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-real-ip'];
@@ -113,32 +85,15 @@ export function isDirectLoopbackRequest(request: IncomingMessage): boolean {
     !PROXY_HEADERS.some(header => request.headers[header] !== undefined);
 }
 
-/**
- * Request handler answering GET with the stats as HTML, or as JSON for `?format=json`; any other method gets 404
- * and an unparsable request target 400. It never throws, so it is safe on a bare `http` server.
- */
+/** Request handler answering GET with the stats as JSON; any other method gets 404. */
 export function createSsrCacheStatsHandler(getStats: () => SsrCacheStats): (request: IncomingMessage, response: ServerResponse) => void {
   return (request, response) => {
     response.setHeader('Cache-Control', 'no-store');
-    response.setHeader('X-Content-Type-Options', 'nosniff');
-    response.setHeader('Content-Security-Policy', "default-src 'none'; base-uri 'none'; frame-ancestors 'none'");
-    let url: URL;
-    try {
-      url = new URL(request.url || '/', 'http://localhost');
-    } catch {
-      response.writeHead(400).end();
-      return;
-    }
     if (request.method !== 'GET') {
       response.writeHead(404).end();
       return;
     }
-    const stats = getStats();
-    if (url.searchParams.get('format') === 'json') {
-      response.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' }).end(JSON.stringify(stats));
-    } else {
-      response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' }).end(renderStatsHtml(stats));
-    }
+    response.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' }).end(JSON.stringify(getStats()));
   };
 }
 
diff --git a/src/config/cache-config.interface.ts b/src/config/cache-config.interface.ts
index e4ad92bb7c7..fbc44a1b9f3 100644
--- a/src/config/cache-config.interface.ts
+++ b/src/config/cache-config.interface.ts
@@ -15,7 +15,7 @@ export interface CacheConfig extends Config {
     debug: boolean,
     // List of response headers to save into the cache
     headers: string[],
-    // Report the contents of the caches below to operators on this host: GET /app/cache-stats (HTML, or ?format=json)
+    // Report the contents of the caches below to operators on this host: GET /app/cache-stats (JSON)
     stats: {
       enabled: boolean,
       // 0 = serve it on the UI port to requests made directly from this host (loopback socket, no proxy headers).

From 7874a1825a43eb178923230b645abc8f63461fcf Mon Sep 17 00:00:00 2001
From: jm <jm@maz>
Date: Fri, 23 Oct 2026 22:06:43 +0200
Subject: [PATCH 5/7] fix(ssr): cache stats route falls through like an unknown
 path, invalid port never stops the UI

Review findings: non-loopback callers got Express's plain 404 instead of
the catch-all route, so the feature was detectable; an invalid stats port
threw synchronously before the UI started; 'enabled' could serialize as 0
or be dropped. Test now covers the query string, trailing slash and HEAD.
---
 scripts/test-ssr-cache-stats.js |  3 +++
 server.ts                       | 21 ++++++++++++++-------
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/scripts/test-ssr-cache-stats.js b/scripts/test-ssr-cache-stats.js
index 441d608c4c5..ae238f9aaf0 100644
--- a/scripts/test-ssr-cache-stats.js
+++ b/scripts/test-ssr-cache-stats.js
@@ -70,7 +70,10 @@ test('stats server listens on loopback and answers only GET /app/cache-stats', a
     assert.equal(json.headers.get('cache-control'), 'no-store');
     assert.deepEqual(await json.json(), payload);
 
+    assert.equal((await fetch(`${base}/app/cache-stats?x=1`)).status, 200);
     assert.equal((await fetch(`${base}/other`)).status, 404);
+    assert.equal((await fetch(`${base}/app/cache-stats/`)).status, 404);
+    assert.equal((await fetch(`${base}/app/cache-stats`, { method: 'HEAD' })).status, 404);
     assert.equal((await fetch(`${base}/app/cache-stats`, { method: 'POST' })).status, 404);
 
   } finally {
diff --git a/server.ts b/server.ts
index bff09d8a581..f95e57217e6 100644
--- a/server.ts
+++ b/server.ts
@@ -243,11 +243,11 @@ export function app() {
    * SSR cache contents for operators on this host (see cache.serverSide.stats). With stats.port = 0 they are
    * served here, but only to requests made directly from this host: loopback socket address (not req.ip, which
    * honours X-Forwarded-For when `trust proxy` is on) and no proxy headers, so traffic relayed by a same-host
-   * reverse proxy is refused too. Everyone else gets the same 404 as an unknown route.
+   * reverse proxy is refused too. Everyone else falls through to the catch-all route, exactly as for an unknown path.
    */
   if (environment.cache.serverSide.stats.enabled && environment.cache.serverSide.stats.port === 0) {
     const statsHandler = createSsrCacheStatsHandler(collectCacheStats);
-    server.get(SSR_CACHE_STATS_PATH, (req, res) => isDirectLoopbackRequest(req) ? statsHandler(req, res) : res.sendStatus(404));
+    server.get(SSR_CACHE_STATS_PATH, (req, res, next) => isDirectLoopbackRequest(req) ? statsHandler(req, res) : next());
   }
 
   /**
@@ -626,8 +626,8 @@ function collectCacheStats(): SsrCacheStats {
     uptimeSeconds: Math.round(process.uptime()),
     memory: { rss: memory.rss, heapUsed: memory.heapUsed },
     caches: [
-      snapshotCache('bot', botCache, environment.production && botCacheEnabled()),
-      snapshotCache('anonymous', anonymousCache, environment.production && anonymousCacheEnabled())
+      snapshotCache('bot', botCache, !!(environment.production && botCacheEnabled())),
+      snapshotCache('anonymous', anonymousCache, !!(environment.production && anonymousCacheEnabled()))
     ]
   };
 }
@@ -635,13 +635,20 @@ function collectCacheStats(): SsrCacheStats {
 /**
  * Serve the cache stats on a loopback-only port of their own. Every pm2 cluster worker gets basePort + its
  * instance number, because a port shared by the workers would be answered by an arbitrary one.
- * A failed bind is logged and never stops the UI.
+ * An invalid port or a failed bind is logged and never stops the UI.
  */
 function startCacheStatsServer(basePort: number) {
   const port = basePort + CLUSTER_INSTANCE;
-  const statsServer = startSsrCacheStatsServer(port, collectCacheStats);
+  const notStarted = (e: Error) => console.error(`SSR cache stats server not started on port ${port}: ${e.message}`);
+  let statsServer: ReturnType<typeof startSsrCacheStatsServer>;
+  try {
+    statsServer = startSsrCacheStatsServer(port, collectCacheStats);
+  } catch (e) {
+    notStarted(e);
+    return;
+  }
   statsServer.on('listening', () => console.log(`SSR cache stats listening at http://127.0.0.1:${port}${SSR_CACHE_STATS_PATH}`));
-  statsServer.on('error', (e: Error) => console.error(`SSR cache stats server not started on port ${port}: ${e.message}`));
+  statsServer.on('error', notStarted);
   process.on('SIGINT', () => statsServer.close());
 }
 

From 507b085fa9ca53e13279f716f9de45c18edce434 Mon Sep 17 00:00:00 2001
From: jm <jm@maz>
Date: Fri, 23 Oct 2026 22:19:59 +0200
Subject: [PATCH 6/7] fix(ssr): tighten the cache stats guards after review

Refuse every X-Forwarded-* header, not just three of them; narrow the
caught value (useUnknownInCatchVariables on DSpace 9 branches); never
bind the stats listener to the UI port; log an invalid stats port such
as a YAML string instead of ignoring it; let loopback HEAD fall through
like other clients; answer 500 instead of crashing if the snapshot throws.
---
 config/config.example.yml       |  4 ++--
 scripts/test-ssr-cache-stats.js |  2 +-
 server.ts                       | 20 +++++++++++++++-----
 src/backend/ssr-cache-stats.ts  | 14 +++++++++++---
 4 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/config/config.example.yml b/config/config.example.yml
index bfafb3a775e..892be9360ec 100644
--- a/config/config.example.yml
+++ b/config/config.example.yml
@@ -102,8 +102,8 @@ cache:
     stats:
       enabled: false
       # 0 = answer on the UI port, but only to requests made directly from this host: connecting from 127.0.0.1 and
-      # carrying no proxy headers (Forwarded, Via, X-Forwarded-*, X-Real-IP). Everyone else gets 404. A same-host reverse
-      # proxy that adds none of those headers would pass this check, so use a port number there.
+      # carrying no proxy headers (Forwarded, Via, X-Forwarded-*, X-Real-IP). Everyone else is handled by the app like any
+      # unknown path. A same-host reverse proxy that adds none of those headers would pass this check, so use a port number there.
       # A port number (e.g. 4001) = listen on 127.0.0.1:<port> instead; under pm2 cluster mode worker N uses <port> + N,
       # which is the only way to pick a specific worker.
       port: 0
diff --git a/scripts/test-ssr-cache-stats.js b/scripts/test-ssr-cache-stats.js
index ae238f9aaf0..a5478aac91f 100644
--- a/scripts/test-ssr-cache-stats.js
+++ b/scripts/test-ssr-cache-stats.js
@@ -89,7 +89,7 @@ test('direct loopback check accepts local sockets without proxy headers only', (
   for (const address of ['10.0.0.5', '::ffff:10.0.0.5', '0.0.0.0', '', undefined]) {
     assert.equal(isDirectLoopbackRequest(request(address)), false, String(address));
   }
-  for (const header of ['forwarded', 'via', 'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-real-ip']) {
+  for (const header of ['forwarded', 'via', 'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port', 'x-forwarded-ssl', 'x-real-ip']) {
     assert.equal(isDirectLoopbackRequest(request('127.0.0.1', { [header]: '' })), false, header);
   }
   assert.equal(isDirectLoopbackRequest(request('127.0.0.1', { 'user-agent': 'curl' })), true);
diff --git a/server.ts b/server.ts
index f95e57217e6..1af08379ba2 100644
--- a/server.ts
+++ b/server.ts
@@ -247,7 +247,7 @@ export function app() {
    */
   if (environment.cache.serverSide.stats.enabled && environment.cache.serverSide.stats.port === 0) {
     const statsHandler = createSsrCacheStatsHandler(collectCacheStats);
-    server.get(SSR_CACHE_STATS_PATH, (req, res, next) => isDirectLoopbackRequest(req) ? statsHandler(req, res) : next());
+    server.get(SSR_CACHE_STATS_PATH, (req, res, next) => req.method === 'GET' && isDirectLoopbackRequest(req) ? statsHandler(req, res) : next());
   }
 
   /**
@@ -635,11 +635,15 @@ function collectCacheStats(): SsrCacheStats {
 /**
  * Serve the cache stats on a loopback-only port of their own. Every pm2 cluster worker gets basePort + its
  * instance number, because a port shared by the workers would be answered by an arbitrary one.
- * An invalid port or a failed bind is logged and never stops the UI.
+ * An invalid port, a clash with the UI port or a failed bind is logged and never stops the UI.
  */
 function startCacheStatsServer(basePort: number) {
   const port = basePort + CLUSTER_INSTANCE;
-  const notStarted = (e: Error) => console.error(`SSR cache stats server not started on port ${port}: ${e.message}`);
+  const notStarted = (e: unknown) => console.error(`SSR cache stats server not started on port ${port}: ${e instanceof Error ? e.message : String(e)}`);
+  if (port === environment.ui.port) {
+    notStarted('it is the UI port');
+    return;
+  }
   let statsServer: ReturnType<typeof startSsrCacheStatsServer>;
   try {
     statsServer = startSsrCacheStatsServer(port, collectCacheStats);
@@ -655,8 +659,14 @@ function startCacheStatsServer(basePort: number) {
 function start() {
   logStartupMessage(environment);
 
-  if (environment.cache.serverSide.stats.enabled && environment.cache.serverSide.stats.port > 0) {
-    startCacheStatsServer(environment.cache.serverSide.stats.port);
+  const statsConfig = environment.cache.serverSide.stats;
+  if (statsConfig.enabled && statsConfig.port !== 0) {
+    // port 0 is served by the Express app, see app()
+    if (Number.isInteger(statsConfig.port) && statsConfig.port > 0) {
+      startCacheStatsServer(statsConfig.port);
+    } else {
+      console.error(`SSR cache stats server not started: invalid port ${JSON.stringify(statsConfig.port)}`);
+    }
   }
 
   /*
diff --git a/src/backend/ssr-cache-stats.ts b/src/backend/ssr-cache-stats.ts
index 7ee11bbc57a..2da0f41d6e7 100644
--- a/src/backend/ssr-cache-stats.ts
+++ b/src/backend/ssr-cache-stats.ts
@@ -72,7 +72,8 @@ export function snapshotCache(name: string, cache: LRU<string, SsrCacheEntry> |
 
 const LOOPBACK_ADDRESSES = ['127.0.0.1', '::1', '::ffff:127.0.0.1'];
 /** Headers a reverse proxy adds; a request carrying one came through the proxy even if its socket is loopback. */
-const PROXY_HEADERS = ['forwarded', 'via', 'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-real-ip'];
+const PROXY_HEADERS = ['forwarded', 'via', 'x-real-ip'];
+const PROXY_HEADER_PREFIX = 'x-forwarded-';
 
 /**
  * True when the request was made directly on this host: loopback socket address and no proxy headers.
@@ -82,7 +83,7 @@ const PROXY_HEADERS = ['forwarded', 'via', 'x-forwarded-for', 'x-forwarded-host'
 export function isDirectLoopbackRequest(request: IncomingMessage): boolean {
   const address = request.socket.remoteAddress;
   return address !== undefined && LOOPBACK_ADDRESSES.includes(address) &&
-    !PROXY_HEADERS.some(header => request.headers[header] !== undefined);
+    !Object.keys(request.headers).some(header => PROXY_HEADERS.includes(header) || header.startsWith(PROXY_HEADER_PREFIX));
 }
 
 /** Request handler answering GET with the stats as JSON; any other method gets 404. */
@@ -93,7 +94,14 @@ export function createSsrCacheStatsHandler(getStats: () => SsrCacheStats): (requ
       response.writeHead(404).end();
       return;
     }
-    response.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' }).end(JSON.stringify(getStats()));
+    let body: string;
+    try {
+      body = JSON.stringify(getStats());
+    } catch {
+      response.writeHead(500).end();
+      return;
+    }
+    response.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' }).end(body);
   };
 }
 

From 16a7ef1deff77d3f82bf565e2dddf03b69507ddc Mon Sep 17 00:00:00 2001
From: jm <jm@maz>
Date: Fri, 23 Oct 2026 22:30:08 +0200
Subject: [PATCH 7/7] test(ssr): cover the 500 path of the cache stats handler,
 tidy the guards

Review nits: exact-path check on the Express route (non-strict routing
matched /app/cache-stats/ and case variants), warn when the stats are on
the UI port while ui.useProxies is on, distinguish a bind failure from a
later server error in the log, drop a stale peek() mention.
---
 scripts/test-ssr-cache-stats.js | 12 ++++++++++++
 server.ts                       | 14 +++++++++++---
 src/backend/ssr-cache-stats.ts  |  2 +-
 3 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/scripts/test-ssr-cache-stats.js b/scripts/test-ssr-cache-stats.js
index a5478aac91f..a3c1fd1d49d 100644
--- a/scripts/test-ssr-cache-stats.js
+++ b/scripts/test-ssr-cache-stats.js
@@ -81,6 +81,18 @@ test('stats server listens on loopback and answers only GET /app/cache-stats', a
   }
 });
 
+test('stats server answers 500 when the snapshot throws', async () => {
+  const server = startSsrCacheStatsServer(0, () => { throw new Error('boom'); });
+  try {
+    await once(server, 'listening');
+    const response = await fetch(`http://127.0.0.1:${server.address().port}/app/cache-stats`);
+    assert.equal(response.status, 500);
+    assert.equal(response.headers.get('cache-control'), 'no-store');
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+});
+
 test('direct loopback check accepts local sockets without proxy headers only', () => {
   const request = (remoteAddress, headers = {}) => ({ socket: { remoteAddress }, headers });
   for (const address of ['127.0.0.1', '::1', '::ffff:127.0.0.1']) {
diff --git a/server.ts b/server.ts
index 1af08379ba2..f4502d314a5 100644
--- a/server.ts
+++ b/server.ts
@@ -246,8 +246,12 @@ export function app() {
    * reverse proxy is refused too. Everyone else falls through to the catch-all route, exactly as for an unknown path.
    */
   if (environment.cache.serverSide.stats.enabled && environment.cache.serverSide.stats.port === 0) {
+    if (environment.ui.useProxies) {
+      console.warn('SSR cache stats are served on the UI port behind a proxy; a same-host proxy adding no forwarding headers would expose them. Prefer cache.serverSide.stats.port > 0.');
+    }
     const statsHandler = createSsrCacheStatsHandler(collectCacheStats);
-    server.get(SSR_CACHE_STATS_PATH, (req, res, next) => req.method === 'GET' && isDirectLoopbackRequest(req) ? statsHandler(req, res) : next());
+    server.get(SSR_CACHE_STATS_PATH, (req, res, next) =>
+      req.method === 'GET' && req.path === SSR_CACHE_STATS_PATH && isDirectLoopbackRequest(req) ? statsHandler(req, res) : next());
   }
 
   /**
@@ -651,8 +655,12 @@ function startCacheStatsServer(basePort: number) {
     notStarted(e);
     return;
   }
-  statsServer.on('listening', () => console.log(`SSR cache stats listening at http://127.0.0.1:${port}${SSR_CACHE_STATS_PATH}`));
-  statsServer.on('error', notStarted);
+  let listening = false;
+  statsServer.on('listening', () => {
+    listening = true;
+    console.log(`SSR cache stats listening at http://127.0.0.1:${port}${SSR_CACHE_STATS_PATH}`);
+  });
+  statsServer.on('error', (e: Error) => listening ? console.error(`SSR cache stats server on port ${port}: ${e.message}`) : notStarted(e));
   process.on('SIGINT', () => statsServer.close());
 }
 
diff --git a/src/backend/ssr-cache-stats.ts b/src/backend/ssr-cache-stats.ts
index 2da0f41d6e7..f59fbe8e740 100644
--- a/src/backend/ssr-cache-stats.ts
+++ b/src/backend/ssr-cache-stats.ts
@@ -42,7 +42,7 @@ export const SSR_CACHE_STATS_PATH = '/app/cache-stats';
 /**
  * Describe every entry resident in an SSR page cache, largest page first.
  * `dump()` visits stale entries too (unlike `forEach`, which skips them when `allowStale` is false);
- * `dump()`, `peek()` and `has()` leave recency and TTL untouched. Byte counting is O(total cached HTML).
+ * `dump()` and `has()` leave recency and TTL untouched. Byte counting is O(total cached HTML).
  */
 export function snapshotCache(name: string, cache: LRU<string, SsrCacheEntry> | undefined, enabled: boolean): SsrCacheSnapshot {
   const entries: SsrCacheEntryStats[] = [];