86264 - Content sent with 'Cache-Control: no-store' should _only_ be reused when browsing via history.

Status: RESOLVED WONTFIX

(Core :: Networking: HTTP, defect)

Description

[Darin Fisher]

Content sent with 'Cache-Control: no-store' should _only_ be reused when
browsing via history.  We currently attempt to validate the 'no-store' content
before reusing, which does not cause problems per-se, but it does seem to
violate the
intention of the 'Cache-Control: no-store' response header.

Comment 1

[Darin Fisher]

let me be more specific:  i believe that servers expect us to not reuse no-store
content, and that servers may use this as a mechanism to require a mandatory
reload (not revalidation) of an URL.  currently, mozilla will attempt to
validate no-store content.

BTW: the reason we even bother to cache no-store content is for the purpose
of browsing via session history, which RFC2616 explicitly permits.

Comment 2

[fournjm8]

I'm working on an online application where users log in and can log out, or get
loogged out when their session expires. I am using a cache control header to
block caching of information so that if their session expires, all subsequent
pages do not load (not from the server or from the cache). Currently, the
application works as expected both in IE 5.5 and in NN4.x. Is there a standard
that I am unaware of that I need to learn more about? the headers I'm sending
are as follows. Any help would be greatly appreciated, even if its just being
pointed towards required reading.

jason
[e-mail]

header ("Expires: Mon, 26 Jul 1997 05:00:00 GMT");    // Date in the past
header ("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); // always modified
header ("Cache-Control: no-cache, must-revalidate");  // HTTP/1.1
header ("Pragma: no-cache");                          // HTTP/1.0

Comment 3

[Darin Fisher]

currently, none of those headers would prevent the user from browsing to the 
page via the Back/Forward buttons.  however, any new link clicks that take the 
user to one of those pages will result in a new server hit.

the header "Cache-Control: no-cache" is equivalent to "Cache-Control:
must-revalidate".

the header "Cache-Control: no-store" just requires that the server response not 
be cached on disk, but it does not prevent the caching of the data for the
purposes of session history (ie. Back/Forward buttons).

Comment 4

[Darin Fisher]

'Cache-control: no-store' now prevents data from being cached at all.

marking this bug as WONTFIX.