296509 - Expired cached content doesn't gets deleted until FireFox is closed

Status: RESOLVED INVALID

(Core :: Networking: Cache, defect)

Description

[jshepard04]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

Content that is cached and expired doesn't leave the cache until FireFox is
closed this creates a problem with things like logins and content that needs to
expire.

  

Reproducible: Always

Steps to Reproduce:
1.Go to bugzilla.mozilla.org and sign in
2.Open a new tab and type in about:cache?device=disk


Actual Results:  
Notice how the expiration is past on the bugzilla.mozilla.org and now its set to
something 12/31/69 18:00:00  This means the content has expired.

Expected Results:  
Once content expires it should be deleted, this is how it is done in IE and it
should be done this way in all browsers, as it creates a headache for developers
trying to make their application secure, if this content isn't deleted then the
user can click the back button and view what as last accessed.

Comment 1

[Elmar Ludwig]

Not a blocker, over to Core/Networking:Cache

Comment 2

[jshepard04]

This bug is rather cosmetic in nature, but here are the main problems:

View Page Info -> Says "No expiration set", change to Expired when Expired < NOW
Remove Expired content from cache or prevent Firefox from using expired content.
 One ploblem this is said to create is a allowing users to use the back button.
 This is really not the case, instead developers should us Cache-Control:
no-store to prevent back button usage.  Common mistake is using Cache-Control:
no-cache.

Comment 3

[Darin Fisher]

This bug report is INVALID.  Expired content is still useful for back/forward
navigation, view->pagesource, and file->saveas.  Moreover, expired content may
be validated using a conditional query in the future (If-Modified-Since or
If-None-Match), so there is no reason not to store expired content in the cache.

Use 'Cache-control: no-store' if you really don't want your content to live in
the browser cache.

Marking INVALID.