162545 - Mozilla does not honor NO-CACHE requests

Status: VERIFIED WONTFIX

(Core :: Networking: HTTP, defect)

Description

[Jose Elias]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.0) Gecko/20020530
BuildID:    2002053012

Mozilla ignores no-cache HTTP requests. I'm sending it HTTP 1.0 and HTTP 1.1
no-cache requests, and while doing that works on all other browsers (old and
new), Mozilla ignores it.

Reproducible: Always
Steps to Reproduce:
Step 1:
On a Java-based Servlet container, I set my response like this:
response.setHeader("Cache-Control","no-cache"); //HTTP 1.1
response.setHeader("Pragma","no-cache"); //HTTP 1.0
response.setDateHeader("Expires", 0); //prevents caching at the proxy server

Step 2: When I try browsing web pages with the HTTP response set as above,
Mozilla ignores the cache WHEN I HIT THE BACK BUTTON. Remember that the reason
one usually tries to turn off the cache, is to avoid the user seeing an old page
when they hit the BACK button or when they visit it again.

Actual Results:  Hitting the back button in Mozilla does NOT make a new request
to the HTTP Server (instead it loads it from its built-in cache instead of not
caching the page).

Expected Results:  Mozilla should not have saved the page to the cache, and
instead when the back button was hit it should have requested the page from the
HTTP server again.

To whoever is in charge of taking a look at this: This should be a super high
priority fix, since virtually any e-commerce store or eBusiness app needs this
functionality to work correctly.

Comment 1

[Darin Fisher]

Actually, Mozilla's implementation of Back/Forward is completely conformant with
RFC 2616.  The fact of the matter is that 'Cache-control: no-cache' when sent as
a response header need not influence what a browser can do when the user presses
the back button.  In fact, 'Cache-control: no-cache' only requires the
user-agent to validate the original document before showing it again following a
link click or other normal load.  A load from session history (the Back button)
need not honor 'Cache-control: no-cache.'  no-cache does not mean that the
browser cannot put the document in its cache; it only means that the browser
must validate it with the origin server before using it to satisfy a new request.

The correct way to prevent a user from seeing a document again when they press
the back button is to send 'Cache-control: no-store'.  This header tells the
user-agent that the document being fetched contains sensitive information that
should not be kept around very long.  Mozilla will always fetch a no-store
document from the server when the user navigates to it via the Back button. 
MSIE also implements 'Cache-control: no-store' in exactly the same way, for what
it's worth.

Comment 2

[John Unruh]

Verified wontfix.

Comment 3

[Darin Fisher]

*** Bug 237905 has been marked as a duplicate of this bug. ***

Comment 4

[Christian :Biesinger (don't email me, ping me on IRC)]

*** Bug 276631 has been marked as a duplicate of this bug. ***