WebApp Sec: RE: How to prevent Internet Explorer from locally caching pages

["David Cameron" <dcameron () itis-now com>]

Try setting the cache-control to private, pragma to no-cache as well as setting the page to expired.

regards
David Cameron
nOw.b2b
dcameron () itis-now com

> -----Original Message-----
> From: Adrian Caneva [mailto:acaneva () nexttech com ar]
> Sent: Friday, 4 April 2003 10:27 AM
> To: webappsec () securityfocus com
> Subject: How to prevent Internet Explorer from locally caching pages
>
>
>
>
> Hi,
>
> Expiration headers seem to be ignored by Internet Explorer 
> behind a Proxy 
>
> server when using BACK / FORWARD buttons.
>
> On Microsoft's Knowledge Base Article  234067 (HOWTO: Prevent 
> Caching in 
>
> Internet Explorer) I've found that in fact this can happen.
>
> And I could verify that, behind a Proxy, IE (6.0, 5.5, 5.0) 
> gets the page 
>
> from local disk cache although Expire = -1 header should 
> force it ask the 
>
> web server for an updated version.
>
> The only workaround I've found was to place dynamic pages in 
> an https:// 
>
> environment where (Pragma, no-cache) header prevents IE from 
> storing in 
>
> local cache the response.
>
> Any better ideas ?
>
>
>
> Thanks very much in advance.
>
> Regards,
>
>
>
> Adrian Caneva