Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <h1>Introduction</h1> <p>The correct minimum set of headers that works across all mentioned clients (and proxies):</p> <pre><code>Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 </code></pre> <p>The <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9" rel="noreferrer"><code>Cache-Control</code></a> is per the HTTP 1.1 spec for clients and proxies (and implicitly required by some clients next to <code>Expires</code>). The <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.32" rel="noreferrer"><code>Pragma</code></a> is per the HTTP 1.0 spec for prehistoric clients. The <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.21" rel="noreferrer"><code>Expires</code></a> is per the HTTP 1.0 and 1.1 spec for clients and proxies. In HTTP 1.1, the <code>Cache-Control</code> takes precedence over <code>Expires</code>, so it's after all for HTTP 1.0 proxies only.</p> <p>If you don't care about IE6 and its broken caching when serving pages over HTTPS with only <code>no-store</code>, then you could omit <code>Cache-Control: no-cache</code>.</p> <pre><code>Cache-Control: no-store, must-revalidate Pragma: no-cache Expires: 0 </code></pre> <p>If you don't care about IE6 nor HTTP 1.0 clients (HTTP 1.1 was introduced 1997), then you could omit <code>Pragma</code>.</p> <pre><code>Cache-Control: no-store, must-revalidate Expires: 0 </code></pre> <p>If you don't care about HTTP 1.0 proxies either, then you could omit <code>Expires</code>.</p> <pre><code>Cache-Control: no-store, must-revalidate </code></pre> <p>On the other hand, if the server auto-includes a valid <code>Date</code> header, then you could theoretically omit <code>Cache-Control</code> too and rely on <code>Expires</code> only.</p> <pre><code>Date: Wed, 24 Aug 2016 18:32:02 GMT Expires: 0 </code></pre> <p>But that may fail if e.g. the enduser manipulates the operating system date and the client software is relying on it.</p> <p>Other <code>Cache-Control</code> parameters such as <code>max-age</code> are irrelevant if the abovementioned <code>Cache-Control</code> parameters are specified. The <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.29" rel="noreferrer"><code>Last-Modified</code></a> header as included in most other answers here is <em>only</em> interesting if you <strong>actually want</strong> to cache the request, so you don't need to specify it at all.</p> <h1>How to set it?</h1> <p>Using PHP:</p> <pre class="lang-php prettyprint-override"><code>header("Cache-Control: no-cache, no-store, must-revalidate"); // HTTP 1.1. header("Pragma: no-cache"); // HTTP 1.0. header("Expires: 0"); // Proxies. </code></pre> <p>Using Java Servlet, or Node.js:</p> <pre class="lang-java prettyprint-override"><code>response.setHeader("Cache-Control", "no-cache, no-store, must-revalidate"); // HTTP 1.1. response.setHeader("Pragma", "no-cache"); // HTTP 1.0. response.setHeader("Expires", "0"); // Proxies. </code></pre> <p>Using ASP.NET-MVC</p> <pre class="lang-cs prettyprint-override"><code>Response.Cache.SetCacheability(HttpCacheability.NoCache); // HTTP 1.1. Response.Cache.AppendCacheExtension("no-store, must-revalidate"); Response.AppendHeader("Pragma", "no-cache"); // HTTP 1.0. Response.AppendHeader("Expires", "0"); // Proxies. </code></pre> <p>Using ASP.NET Web API:</p> <pre class="lang-cs prettyprint-override"><code>// `response` is an instance of System.Net.Http.HttpResponseMessage response.Headers.CacheControl = new CacheControlHeaderValue { NoCache = true, NoStore = true, MustRevalidate = true }; response.Headers.Pragma.ParseAdd("no-cache"); // We can't use `response.Content.Headers.Expires` directly // since it allows only `DateTimeOffset?` values. response.Content?.Headers.TryAddWithoutValidation("Expires", 0.ToString()); </code></pre> <p>Using ASP.NET:</p> <pre class="lang-cs prettyprint-override"><code>Response.AppendHeader("Cache-Control", "no-cache, no-store, must-revalidate"); // HTTP 1.1. Response.AppendHeader("Pragma", "no-cache"); // HTTP 1.0. Response.AppendHeader("Expires", "0"); // Proxies. </code></pre> <p>Using ASP:</p> <pre class="lang-vb prettyprint-override"><code>Response.addHeader "Cache-Control", "no-cache, no-store, must-revalidate" ' HTTP 1.1. Response.addHeader "Pragma", "no-cache" ' HTTP 1.0. Response.addHeader "Expires", "0" ' Proxies. </code></pre> <p>Using Ruby on Rails, or Python/Flask:</p> <pre class="lang-rb prettyprint-override"><code>response.headers["Cache-Control"] = "no-cache, no-store, must-revalidate" # HTTP 1.1. response.headers["Pragma"] = "no-cache" # HTTP 1.0. response.headers["Expires"] = "0" # Proxies. </code></pre> <p>Using Python/Django:</p> <pre class="lang-py prettyprint-override"><code>response["Cache-Control"] = "no-cache, no-store, must-revalidate" # HTTP 1.1. response["Pragma"] = "no-cache" # HTTP 1.0. response["Expires"] = "0" # Proxies. </code></pre> <p>Using Python/Pyramid:</p> <pre class="lang-py prettyprint-override"><code>request.response.headerlist.extend( ( ('Cache-Control', 'no-cache, no-store, must-revalidate'), ('Pragma', 'no-cache'), ('Expires', '0') ) ) </code></pre> <p>Using Google Go:</p> <pre class="lang-default prettyprint-override"><code>responseWriter.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate") // HTTP 1.1. responseWriter.Header().Set("Pragma", "no-cache") // HTTP 1.0. responseWriter.Header().Set("Expires", "0") // Proxies. </code></pre> <p>Using Apache <code>.htaccess</code> file:</p> <pre class="lang-xml prettyprint-override"><code>&lt;IfModule mod_headers.c&gt; Header set Cache-Control "no-cache, no-store, must-revalidate" Header set Pragma "no-cache" Header set Expires 0 &lt;/IfModule&gt; </code></pre> <p>Using HTML4:</p> <pre class="lang-html prettyprint-override"><code>&lt;meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" /&gt; &lt;meta http-equiv="Pragma" content="no-cache" /&gt; &lt;meta http-equiv="Expires" content="0" /&gt; </code></pre> <h1>HTML meta tags vs HTTP response headers</h1> <p>Important to know is that when a HTML page is served over a HTTP connection, and a header is present in <strong>both</strong> the HTTP response headers and the HTML <code>&lt;meta http-equiv&gt;</code> tags, then the one specified in the HTTP response header will get precedence over the HTML meta tag. The HTML meta tag will only be used when the page is viewed from local disk file system via a <code>file://</code> URL. See also <a href="http://www.w3.org/TR/html4/charset.html#h-5.2.2" rel="noreferrer">W3 HTML spec chapter 5.2.2</a>. Take care with this when you don't specify them programmatically, because the webserver can namely include some default values. </p> <p>Generally, you'd better just <strong>not</strong> specify the HTML meta tags to avoid confusion by starters, and rely on hard HTTP response headers. Moreover, specifically those <code>&lt;meta http-equiv&gt;</code> tags are <a href="http://validator.w3.org" rel="noreferrer"><strong>invalid</strong></a> in HTML5. Only the <code>http-equiv</code> values listed in <a href="http://w3c.github.io/html/document-metadata.html#pragma-directives" rel="noreferrer">HTML5 specification</a> are allowed.</p> <h1>Verifying the actual HTTP response headers</h1> <p>To verify the one and other, you can see/debug them in HTTP traffic monitor of webbrowser's developer toolset. You can get there by pressing F12 in Chrome/Firefox23+/IE9+, and then opening the "Network" or "Net" tab panel, and then clicking the HTTP request of interest to uncover all detail about the HTTP request and response. The <a href="https://i.stack.imgur.com/fSnXH.png" rel="noreferrer">below screenshot</a> is from Chrome:</p> <p><img src="https://i.stack.imgur.com/fSnXH.png" alt="Chrome developer toolset HTTP traffic monitor showing HTTP response headers on stackoverflow.com"></p> <h1>I want to set those headers on file downloads too</h1> <p>First of all, this question and answer is targeted on "web pages" (HTML pages), not "file downloads" (PDF, zip, Excel, etc). You'd better have them cached and make use of some file version identifier somewhere in URI path or querystring to force a redownload on a changed file. When applying those no-cache headers on file downloads anyway, then beware of the IE7/8 bug when serving a file download over HTTPS instead of HTTP. For detail, see <a href="https://stackoverflow.com/q/5034454">IE cannot download foo.jsf. IE was not able to open this internet site. The requested site is either unavailable or cannot be found</a>.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload