Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

i know that cache control headers can be set on the pages coming out from the web-servers (that is responses). Does anyone know how cache control header should be set on the requests? Should it be done via client-side scripting? If yes, how?

share|improve this question
add comment

4 Answers 4

Cache-control requests are managed by the browser, there is no real reason to try and modify them. Firstly, for any URL visited, and all external requests from that page (images, scripts, styles) there is no way to control the requests.

For AJAX requests made after the page has loaded, it is possible to send specific headers (as detailed here), but it's complex and probably pointless. You don't say what your use-case is but you should probably just make your server send appropriate headers for the files in the first place.

share|improve this answer
    
my intention is to not cache confidential data being filled out in forms on the client side. I am looking for a solution for both HTTP 1.1 and 1.0 protocol (if possible). Yesterday, when i re-read the HTTP 1.1 RFC, it said that by specifying the 'no-store' option, we can attain request cache control via responses: "If sent in a response, a cache MUST NOT store any part of either this response or the request that elicited it". So, that solved my problem for HTTP 1.1 protocol, but for HTTP 1.0 there doesn't seem to be any solution because the Pragma no-cache option is only for requests. –  Pradeep Jun 12 '12 at 6:17
    
There are several ways for your server to tell the browser not to cache the current page (e.g. Cache-control: no-cache). You can also set the form to autocomplete="off" which prevents the submitted data being saved. –  DisgruntledGoat Jun 12 '12 at 18:18
add comment

All right, this is an old question, but here goes:

Cache control headers mainly have meaning for responses, i.e. what the server sends to the client. Setting cache control headers on the request is usually incorrect and meaningless.

The origin server sets the cache control headers, based on what is needed for the specific content. The person or organization managing the origin server configures this.

Caveats:

It is possible for the client software to disobey the cache control headers in violation of the RFCs, and store content which is explicitly marked cache-control: no-store and expires: <date-in-the-past> . Such behavior is wrong, but since the client software (browser) is under the end users control, it's up to him to address this.

It is also possible for intermediary http caches (proxies) to disobey the caching headers on responses. And similarly, the individual or organization controlling the intermediary cache should fix this (and end users shouldn't permit intermediary caches which they don't trust).

Special case:

In some circumstances, clients can specify certain criteria for which responses the client is willing to accept. See RFC 2616 section 13.1.6 Client-controlled Behavior. This is rarely used, and I wouldn't be surprised if a few intermediary caches out in the real world (less common corporate firewalls / anti-virus gateways / WAN accelerators) have bugs in the handling of this.

Lastly: I always recommend Mark Nottingham's Caching Tutorial for Web Authors and Webmasters as a really good, practical introduction to HTTP caching mechanisms.

share|improve this answer
add comment

I admit there might be cases when you want to alter the request headers, and it is easy enough to do for AJAX requests. I don't know any way of doing it for the "normal" click-on-link-request from the browser. Cf http://stackoverflow.com/questions/374885/can-i-change-the-headers-of-the-http-request-send-by-the-browser

But why would you alter the request headers? Are there anything like a cached request? The whole idea of constructing a request and send it to the server seems to be dynamic to me. What is it you want to achieve?

share|improve this answer
    
my intention is to instruct the browser to not cache confidential data being filled out in forms. HTTP 1.1 protocol states that cache control directives can be request or response specific. I was looking for a way to do it for requests. I found some way of doing it for HTTP 1.1 - please see my comment to DisgruntledGoat. –  Pradeep Jun 12 '12 at 6:25
    
Thanks, I understand better your intention. I'm afraid I can't really help you better anyway, but I'd like to offer a couple of points to ponder. It is all HTTP that is considered here. Of course, you'll want HTTPS or some secure transport, so your confidential data can't be snooped on its way to the server. This will also ensure (as far as I can see) that even if it is cached, it will not be readable: Even if there might be a cache header that should prevent caching, there is no guarantee that servers comply to the spec. –  norwebian Jun 18 '12 at 7:52
add comment

I set cache control through PHP server side. At the top of your page, use the following code:

<?
    // Prevent caching
    header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
    header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past
?>

Using a date from the past ensures that the newest version of the page will always be downloaded.

share|improve this answer
    
I guess that sets the cache-control on the responses. Not sure how to do that for requests. –  Pradeep Jun 11 '12 at 13:30
    
SK , that can get very expensive in regards to resources. Why not cache static resources? –  Frank Jun 18 '12 at 9:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.