You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Bill Barker <wb...@wilshire.com> on 2003/07/16 07:30:20 UTC
[PROPOSAL] Add Post to the clear list for protected pages
At the moment (with the default settings), Tomcat 4.1.x and higher add HTTP
headers to non-SSL protected pages to prevent intermediate proxies from
caching them. According to the HTTP/1.1 RFC (and even the HTTP/1.0 RFC),
POSTed pages are not allowed to be cached by proxies (for the obvious
reasons). I'd like to add request.getMethod().equals("POST") to the list of
conditions to *not* add the headers.
I'm happy if I can do this in 5.x, and ecstatic if I can back-port it to
4.1.x (since it almost removes my need to configure the Authenticator).
Re: [PROPOSAL] Add Post to the clear list for protected pages
Posted by Michael Smith <ms...@speedlegal.com>.
Costin Manolache wrote:
> Bill Barker wrote:
>
>
>>At the moment (with the default settings), Tomcat 4.1.x and higher add
>>HTTP headers to non-SSL protected pages to prevent intermediate proxies
>>from
>>caching them. According to the HTTP/1.1 RFC (and even the HTTP/1.0 RFC),
>>POSTed pages are not allowed to be cached by proxies (for the obvious
>>reasons). I'd like to add request.getMethod().equals("POST") to the list
>>of conditions to *not* add the headers.
>
>
> Not sure I understand :-)
>
> The RFC requires that proxies don't cache POST requests. Are you saying
> we should *not* include the headers, because proxies will not cache anyway ?
> Or to add the headers ? And what does it has to do with SSL ?
>
(as an interested observer who has been fighting caching problems both
with and without SSL for the last couple of days...)
Currently tomcat sets no-cache headers (Pragma: no-cache, Cache-Control:
no-cache, and an Expires header) IF:
The resource is protected (requires authentication)
AND The resource is NOT accessed via SSL (since intermediaries
won't ache things that are using SSL, I think). This is also neccesary
to get internet explorer to behave sanely when serving files that it
needs to open in an external program.
There's also a flag that disables this behaviour entirely.
As you correctly interpreted, Bill's suggestion is that these headers
should _not_ be added for POST requests, because intermediaries will not
cache these anyway. Disallowing caching has a tendency to cause
undesirable behaviour on the client end (at least with IE, which many of
us have to support), so my guess is that that is why Bill doesn't want
these headers added in this case.
Mike Smith
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
Re: [PROPOSAL] Add Post to the clear list for protected pages
Posted by Glenn Nielsen <gl...@mail.more.net>.
Remy Maucherat wrote:
> Bill Barker wrote:
>
>> I'm saying to *not* include the headers, because any compliant proxy will
>> not cache anyway. At the moment, SSL connections do not set the headers
>> (since they also can't be cached), and that is the only current
>> exception.
>>
>> At the moment, hitting the "back" button in the browser to a protected
>> POSTed page forces you to re-post to view the page. This is generally
>> a-bad-thing, since it results in you getting two copies of Madonna's
>> CD (and
>> charged twice ;-).
>
>
> +1 from me.
> Thanks for the explanation :)
>
+1, also to back port the change to 4.1
Glenn
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
Re: [PROPOSAL] Add Post to the clear list for protected pages
Posted by Remy Maucherat <re...@apache.org>.
Bill Barker wrote:
> I'm saying to *not* include the headers, because any compliant proxy will
> not cache anyway. At the moment, SSL connections do not set the headers
> (since they also can't be cached), and that is the only current exception.
>
> At the moment, hitting the "back" button in the browser to a protected
> POSTed page forces you to re-post to view the page. This is generally
> a-bad-thing, since it results in you getting two copies of Madonna's CD (and
> charged twice ;-).
+1 from me.
Thanks for the explanation :)
Remy
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
Re: [PROPOSAL] Add Post to the clear list for protected pages
Posted by Bill Barker <wb...@wilshire.com>.
----- Original Message -----
From: "Costin Manolache" <cm...@yahoo.com>
To: <to...@jakarta.apache.org>
Sent: Wednesday, July 16, 2003 8:38 PM
Subject: Re: [PROPOSAL] Add Post to the clear list for protected pages
> Bill Barker wrote:
>
> > At the moment (with the default settings), Tomcat 4.1.x and higher add
> > HTTP headers to non-SSL protected pages to prevent intermediate proxies
> > from
> > caching them. According to the HTTP/1.1 RFC (and even the HTTP/1.0
RFC),
> > POSTed pages are not allowed to be cached by proxies (for the obvious
> > reasons). I'd like to add request.getMethod().equals("POST") to the
list
> > of conditions to *not* add the headers.
>
> Not sure I understand :-)
>
> The RFC requires that proxies don't cache POST requests. Are you saying
> we should *not* include the headers, because proxies will not cache anyway
?
> Or to add the headers ? And what does it has to do with SSL ?
>
I'm saying to *not* include the headers, because any compliant proxy will
not cache anyway. At the moment, SSL connections do not set the headers
(since they also can't be cached), and that is the only current exception.
At the moment, hitting the "back" button in the browser to a protected
POSTed page forces you to re-post to view the page. This is generally
a-bad-thing, since it results in you getting two copies of Madonna's CD (and
charged twice ;-).
> ( I'm +0 any way )
>
> Costin
>
>
>
> > I'm happy if I can do this in 5.x, and ecstatic if I can back-port it to
> > 4.1.x (since it almost removes my need to configure the Authenticator).
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
>
Re: [PROPOSAL] Add Post to the clear list for protected pages
Posted by Costin Manolache <cm...@yahoo.com>.
Bill Barker wrote:
> At the moment (with the default settings), Tomcat 4.1.x and higher add
> HTTP headers to non-SSL protected pages to prevent intermediate proxies
> from
> caching them. According to the HTTP/1.1 RFC (and even the HTTP/1.0 RFC),
> POSTed pages are not allowed to be cached by proxies (for the obvious
> reasons). I'd like to add request.getMethod().equals("POST") to the list
> of conditions to *not* add the headers.
Not sure I understand :-)
The RFC requires that proxies don't cache POST requests. Are you saying
we should *not* include the headers, because proxies will not cache anyway ?
Or to add the headers ? And what does it has to do with SSL ?
( I'm +0 any way )
Costin
> I'm happy if I can do this in 5.x, and ecstatic if I can back-port it to
> 4.1.x (since it almost removes my need to configure the Authenticator).
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org