The Rspamd controller sends "Cache-Control: no-store" on every WebUI
response (controller.c, issue #3330) and never emits Last-Modified/ETag
for these endpoints, so a browser never revalidates and a 304 response
is impossible. The `|| xhr.status === 304` in queryServer was dead code
copied from jQuery's default success range.
Remove it so queryServer, the /stat connect probe and the legacy /auth
probe all treat 200-299 as success. Treating 304 as an error is also
safer: a 304 body is empty, and success would have fed it to the JSON
parser.
}
xhr.onload = function () {
- const ok = (xhr.status >= 200 && xhr.status < 300) || xhr.status === 304;
+ const ok = xhr.status >= 200 && xhr.status < 300;
if (!ok) {
handleError("error", xhr.statusText);
return;