Re: Web Cache threaten PHP security!!!

You are asking if there is some magical thing you can do in a PHP script to fix a broken proxy-cache? That completely depends on how the proxy-cache is broken. However, one way to make sure it is never cached is to always change the URL. That is, add a timestamp to every single URL with something like: <form action="checkout.php?<?echo time()?>" type="POST"> ... </form> The fact that there is a '?' in the URL will stop some proxy-caches from caching it, but the fact that the URL is physically different will cause a cache-miss so even though the page may mistakenly be cached, nobody else will ever see it. You could also use something like: <form action="checkout.php<?echo uniqid('?')?>" method="POST"> to create a unique id that is not as predictable as the timestamp. -Rasmus On Fri, 10 Nov 2000, Alex wrote: > Below is what PHP tell us: > PHP scripts often generate dynamic HTML that must not be cached by the > client browser or any proxy caches between the server and the client > browser. Many proxies and clients can be forced to disable caching with > > 1 > 2 header ("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); // Date in the > past > 3 header ("Last-Modified: " . gmdate("D, d M Y H:i:s") . " > GMT"); > 4 // always modified > 5 header ("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 > 6 header ("Pragma: no-cache"); // HTTP/1.0 > 7 > > But the truth is if the proxy ignore HTTP cache control the page stays. > That's what happened to my web site. When customers use the same proxy which > ignore cache control the shopping cart that use the session object may be > shared by them! so do the ship info!!! > Any other PHP solution available? > > > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net >