Re: How to prevent Internet Explorer from locally caching pages

Thanks for your quick responses!
After some research I believe I've found an answer.

Usually web applications send 3 basic headers to prevent caching:

Cache-Control : no-cache
//HTTP 1.1 http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.1

Pragma : no-cache;
//HTTP 1.0 http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.32 for proxies

Expires : -1

Maybe also, some other headers like (cache-control, private). As Liam correctly pointed out (Expire, -1) header is not mandatory. And should be ignored for history retrieving methods if the page is in local cache.
But the page should not be in local cache in the first place because (cache-control, no-cache) header would prevent any intermediate cache from storing it.
The problem with these statement is that is an HTTP/1.1 header. Internet Explorer would evaluate this header only if it comes in an HTTP/1.1 response.
If a Proxy server HTTP/1.0 like Squid is between the web application and the browser, MSIE would receive this header into an HTTP/1.0 response block and will ignore it.
No matter if the web server at the origin is HTTP/1.1 compliant. If the proxy is not in the chain, MSIE behaves as expected not caching locally the response.
Additionaly, Internet Explorer needs advanced setting "Use HTTP 1.1 through proxy connections" to place HTTP 1.1 requests behind a proxy. Microsoft says that for HTTP 1.0 servers (pragma, no cache) header would prevent MSIE from storing local copies of the response if it comes from a secure site. And this is the simplistic workaround.

Best regards and thanks again,

Adrian Caneva

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

>FWIW, IE's behaviour seems to be in agreement with the HTTP/1.1
Received on Fri Apr 4 16:56:27 2003