WebApp Sec mailing list archives
RE: Mozilla Firefox can't disable browser cache. Why?
From: "Tony Stahler" <TStahler () tempographics com>
Date: Wed, 23 Aug 2006 09:44:15 -0500
In previous versions I'd tested a web app I was making - it doesn't cache for normal requests. The back button keeps a certain number of previous pages cached internally no matter what. For instance, when I fill out a form - then go to another page - if I click back it will give me the previous page with all the data still in the form. I just tried packet sniffing on FF 1.0.7, and it doesn't even make a request when you click the back button. Maybe there's somewhere to turn this off, but I've never seen the setting. -Tony -----Original Message----- From: smith.norton () gmail com [mailto:smith.norton () gmail com] Sent: Wednesday, August 23, 2006 8:07 AM To: webappsec () securityfocus com Subject: Mozilla Firefox can't disable browser cache. Why? I have two pages. a.php ------ <?php Header("Pragma: no-cache"); #HTTP 1.0 Header("Cache-control: private, no-cache, no-store"); Header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); ?> <html> <head> <title>1st Page</title> </head> <body> <p> This is the first page.<br> <a href="b.html">Click here</a> to go to the second page. </p> </body> </html> b.html ------ <html> <head> <meta http-equiv="cache-control" content="no-cache"> <title>2nd Page</title> </head> <body> <p> This is the second page.<br> </p> </body> </html> Then I try the following steps:- 1. Open http://[mysite]/a.php 2. Click the link on it to go to b.html. 3. Then click on "Work Offline" from the "File" menu of the browser. 4. Hit the back button. I am expecting that on pressing the back button I shouldn't be able to get a.php since caching was disabled. When I try the above steps with Internet Explorer, I am unable to get back a.php in "offline" mode. So this is OK. But, when I try the above steps with Mozilla Firefox, I am able to get back a.php in "offline" mode even though caching was disabled. Why didn't Mozilla Firefox obey the directives in the HTTP Headers? ------------------------------------------------------------------------ - Sponsored by: Watchfire Watchfire was recently named the worldwide market leader in Web application security assessment tools by both Gartner and IDC. Download a free trial of AppScan today and see why more customers choose AppScan then any other solution. Try it today! https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB ------------------------------------------------------------------------ -- ------------------------------------------------------------------------- Sponsored by: Watchfire Watchfire was recently named the worldwide market leader in Web application security assessment tools by both Gartner and IDC. Download a free trial of AppScan today and see why more customers choose AppScan then any other solution. Try it today! https://www.watchfire.com/securearea/appscancamp.aspx?id=701500000008VnB --------------------------------------------------------------------------
Current thread:
- Mozilla Firefox can't disable browser cache. Why? smith . norton (Aug 23)
- Re: Mozilla Firefox can't disable browser cache. Why? mark (Aug 23)
- RE: Mozilla Firefox can't disable browser cache. Why? Tony Stahler (Aug 23)
- Re: Mozilla Firefox can't disable browser cache. Why? Ron (Aug 23)
- Re: Mozilla Firefox can't disable browser cache. Why? Damien Watson (Aug 24)
- <Possible follow-ups>
- Re: Re: Mozilla Firefox can't disable browser cache. Why? smith . norton (Aug 29)