187582 - Clicking Back button displays page regardless of cache headers

Status: VERIFIED WONTFIX

(SeaMonkey :: General, defect)

Description

[Don Hayward]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3a) Gecko/20021212

A page with cache control headers such as Expires: [Any GMT date before Now], 
Pragma: no-cache, and CacheControl: no-cache or CacheControl: no-cache, must-
revalidate is still cached, and the out-of-date cached version is displayed 
when the back button is clicked.

Reproducible: Always

Steps to Reproduce:
1. Create a web page that is unique every time you retrieve it (you can just 
display the web server's time on the page), and contains a link or a form 
submission to another page. Include cache control headers such as Expires: [Any 
GMT date before Now], Pragma: no-cache, and CacheControl: no-cache, must-
revalidate.
2. Load the page
3. Click the link or submit the form to go to any other page
4. Click the back button

Actual Results:  
A cached version of the page is displayed

Expected Results:  
The page should be reloaded from the web server

View/Page Info reports that the "Source:" is "Disk Cache" (Netscape 7.01 has 
the same bug, but View/Page Info reports that the "Source:" is "(not cached)")

For this version of Mozilla (and for Netscape 7.01) the only way to get the 
page to be reloaded from the web server is to clear the disk cache before 
clicking the back button (so the Page Info in Netscape 7.01 must be incorrect).

Web developers depend on restricting caching on individual pages as a way of 
preventing a form from being submitted twice, among other things. This bug may 
be "by design" but it is not acceptable.

Comment 1

[Wesha]

According to RFC 2616, "Pragma: no-cache" and "Cache-Control: no-cache" SHOULD
NOT affect the back/forward buttons. (see bug 112564)

==> WONTFIX

Comment 2

[Boris Zbarsky [:bzbarsky]]

Note that for an https url, we _will_ make the cache setting affect history, to
prevent people hitting the back button and resubmitting the login form (a
security risk).