10

I have to create a web application that deals with user's sensitive information. I need to immediately clear the browser's cache after user logs out since cached data would be vulnerable. Client's browser should be enforced to clear the Cache from server side. Also all cache policies must be exposed to the client from the server side.

Is there any solution to this problem?

Dunith Dhanushka
  • 4,139
  • 6
  • 26
  • 29
  • 2
    The best you can do is request to the browser (and all intermediate caches -- there might be some) that your pages should not be cached. Even that is only a hint. You cannot programmatically erase a visitor's cache. (Think about what a nightmare that would be.) – Mike Daniels Apr 05 '10 at 03:22

1 Answers1

8

Set the response to expire immediately, and for good measure tell proxies, etc., not to cache:

Expires: 0
Cache-control: private
Marcelo Cantos
  • 181,030
  • 38
  • 327
  • 365