Bug 214361

Summary:	Back cache ignores cache-control: no-cache no-store
Product:	WebKit	Reporter:	Zachary Friss <zfriss>
Component:	WebCore Misc.	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED DUPLICATE
Severity:	Normal	CC:	cdumez
Priority:	P2
Version:	Safari 13
Hardware:	Mac
OS:	Unspecified

Description Zachary Friss 2020-07-15 10:26:00 PDT

When an HTML Page sets `cache-control: no-cache no-store` Safari 13 ignores this and still stores the value in the back/forward cache. 

This is problematic when you explicitly don't want the page to be cached. Example you have a page where the user is logged in then log out and hit "Back" in their browser it seems like they are still logged in due to the cache. 

This behavior isn't present in Safari 12. 

Test site: https://safari-cache-bug.hubspot-product-prod.workers.dev/pageOne.html

Click on Page Two then hit back in browser and see that the time is set to the previous value. 

If you go to Page Three -> Page One and press back page three will show the correct time as that page has a script to reload if it was a cached page load which shouldn't be necessary.  


It seems like this behavior was introduced in https://bugs.webkit.org/show_bug.cgi?id=202314 but it doesn't make sense to ignore a `no-cache no-store` setting.

Comment 1 Alexey Proskuryakov 2020-07-16 18:00:50 PDT

This behaves correctly. Cache-control only affects HTTP cache, and back/forward cache is a completely separate concept.

You may want to look into using pagehide/pageshow events.

Comment 2 Chris Dumez 2020-07-16 18:05:03 PDT


*** This bug has been marked as a duplicate of bug 213147 ***

Comment 3 Chris Dumez 2020-07-16 18:05:47 PDT

(In reply to Alexey Proskuryakov from comment #1)
> This behaves correctly. Cache-control only affects HTTP cache, and
> back/forward cache is a completely separate concept.
> 
> You may want to look into using pagehide/pageshow events.

Alexey is right but we unfortunately had to revert this behavior in bug 213147 for compatibility reasons, for now at least.