Web Cache threaten PHP security!!!
| From: | Alex | Date: | Fri, 10 Nov 2000 06:17:04 +0000 |
| Subject: | Web Cache threaten PHP security!!! | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-24625@lists.php.net to get a copy of this message | ||
Below is what PHP tell us:
PHP scripts often generate dynamic HTML that must not be cached by the
client browser or any proxy caches between the server and the client
browser. Many proxies and clients can be forced to disable caching with
1
2 header ("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); // Date in the
past
3 header ("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
4 // always modified
5 header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
6 header ("Pragma: no-cache"); // HTTP/1.0
7
But the truth is if the proxy ignore HTTP cache control the page stays.
That's what happened to my web site. When customers use the same proxy which
ignore cache control the shopping cart that use the session object may be
shared by them! so do the ship info!!!
Any other PHP solution available?