I am working on a web-based editor, where I can edit HMTL pages online.
I have my Apache webserver configured to send
Cache-control: no-cache with all responses, which means that:
The response may be stored by any cache, even if the response is normally non-cacheable. However, the stored response MUST always go through validation with the origin server first before using it...
I have Chrome set to "Continue where you left off". When I first start Chrome, it often shows an older version of my page, not the latest one that I have saved. It only updates to the latest version when I reload the page. So, it seems that Chrome is not respecting the
Cache-control: no-cache directive in this case.
I can potentially lose data from this, if I accidentally work on and older version of the page.
I think this is a pretty serious bug in Chrome. Can you suggest a workaround? Do other browsers properly respect
I've tested this out a bit more, it can also happen when I re-open a tab with ctrl-shift-T. It doesn't seem to happen if I enter the URL in the address bar and load the page in that way.
On startup with "Continue where you left off", Chrome will also show resources that are password protected (with HTTP auth), without asking for the password again. When I refresh the resource, it asks for the password. I'd better add
Cache-control: no-store for those resources.
I reported this as a Chromium bug. It also occurs in Firefox and Edge, at least when re-opening a closed tab.