So, You Don't Want To Cache, Huh?

By Joe Burns

How Can I Disable Browser Caching for a Web Page?

 

Use these to jump around or read it all...

[IE First]
[Pragma Doesn't Work in IE 5]
[ASP Pages Use This]
[Navigator Next]

I get letters now and again asking how to make it so that when a page is loaded into a browser, that page will not be loaded into the browser's cache. Someone would want to do this for a few different reasons. First, if the page contains information that will be readily updated through a refresh command of some sort, you don't want a page in cache to thwart the process. You want the page to be reloaded from the server each time.

Another big concern is when someone is filling out forms. You really don't want the pages cached because if they are, credit card numbers and addresses and all kinds of stuff can be gathered from the cached page.

When people talk about not caching a page, the talk of this command usually comes up:

<META HTTP-EQUIV="Pragma" CONTENT="no-cache">

The old statement was always, plop that between your head commands and you're good to go. No cache! Well, that's just not the case. There are bugs in both Netscape Navigator (NN) and Internet Explorer (IE).

So, if you're really interested in not caching a page, read on.

 


The Pragma statement up above sometimes fails in IE because of the way IE caches files. There is a 64K buffer that must be filled before a page is cached in IE. The problem is that the vast majority of the pages using the Pragma statement put it between the HEAD tags.

The HEAD loads and the Pragma comes into play. The browser gets the go ahead to not cache the page, however there is not yet a page to not cache. How's that for backwards logic? Since the page hasn't filled the 64K buffer, there's no page so the Pragma is ignored. Thus...the page is cached.

The solution is to play to the buffer. If you're really serious about the Pragma working, place another set of HEAD tags at the bottom of the document, before the end HTML tag and re-enter the Pragma. This is a suggestion straight from Microsoft Support. The page would look like this:

<HTML>
<HEAD>
<TITLE>---</TITLE>
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
</HEAD>
<BODY>

Text in the Browser Window

</BODY>
<HEAD>
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
</HEAD>
</HTML>


This way the Pragma is pretty sure to be read when the buffer is filled.

 


It was news to me too. In order to assure a non-cache, you'll need to add another meta tag:

<META HTTP-EQUIV="Expires" CONTENT="-1">

That sets an immediate expiration on the file. Thus it dies the moment is it born. Place it on your page in the same manner as above. Since you still have the 64k buffer problem to worry about, I would place it in both HEAD tag sections. Better to be safe than sorry. It should look like this:

<HTML>
<HEAD>
<TITLE>---</TITLE>
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
<META HTTP-EQUIV="Expires" CONTENT="-1">
</HEAD>
<BODY>

Text in the Browser Window

</BODY>
<HEAD>
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
<META HTTP-EQUIV="Expires" CONTENT="-1">
</HEAD>
</HTML>

 


If you write in ASP and want the same non-cache effect, here's the header information.

<% Response.CacheControl = "no-cache" %>>
<% Response.AddHeader "Pragma", "no-cache" %>
<% Response.Expires = -1 %>

I didn't read anything about placing it a second time, but better safe than sorry.

If you're using ASP.Net, you can use the following code to achieve the same effect (and it works for IE and Firefox):

// Stop Caching in IE
Response.Cache.SetCacheability(System.Web.HttpCacheability.NoCache);

// Stop Caching in Firefox
Response.Cache.SetNoStore
();



Netscape Navigator recognizes a bug when using the Pragma in secure server situations. The site states that even if the pragma command is used, as long as the browser is never closed, the BACK button will enable someone to see the information entered.

Netscape suggests that people shut down the browser after entering to the screen so that the BACK button doesn't have a history to scroll through.

In addition, Netscape suggests the following JavaScript be used in the BODY tag of all pages that should not be cached:

onLoad="if ('Navigator' == navigator.appName) document.forms[0].reset();"

 


All of my readings got into the concept of Pragma in both secure and non-secure settings. I guess there's some reason to it, but I'm a fan of not taking chances. If you want a page to not cache. Put these statements on it, but keep in mind, there may very well still be a hole no one has found yet.

  Enjoy!

 

 

[IE First]
[Pragma Doesn't Work in IE 5]
[ASP Pages Use This]
[Navigator Next]


Make a Comment

Loading Comments...

  • Web Development Newsletter Signup

    Invalid email
    You have successfuly registered to our newsletter.
  •  
  •