How to turn off caching

[janole]

How do i turn off caching of html pages in JBoss Portal?

what I want is to set
<meta http-equiv="Expires" content="0">
<meta http-equiv="Pragma" content="no-cache">
in the html response for some pages in my portal.

First I tried to set
<expiration-cache>0</expiration-cache>
in portlet.xml

My portlet.xml:
<?xml version="1.0" encoding="UTF-8"?>
<portlet-app xmlns="http://java.sun.com/xml/ns/portlet/portlet-app_1_0.xsd"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/portlet/portlet-app_1_0.xsd /opt/SUNWps/dtd/portlet.xsd" version="1.0">

<portlet-name>HelloWorldPortlet</portlet-name>
<portlet-class>no.solarsoft.helloworld.portlet.HelloPortlet</portlet-class>
<supported-locale>en</supported-locale>
<resource-bundle>Resource</resource-bundle>
<expiration-cache>0</expiration-cache>

<mime-type>text/html</mime-type>
<portlet-mode>VIEW</portlet-mode>
<portlet-mode>HELP</portlet-mode>
<portlet-mode>EDIT</portlet-mode>

<init-param>
Test param
test
1
</init-param>
<portlet-info>
Hello World Portlet
</portlet-info>

</portlet-app>

But <expiration-cache> does not seem to work.

How can this be done?

I', using JBoss Portal 2.0 Alpha on Jboss 4.0.1RC2

[mholzner]

portlets don't control this behaviour.
The portal is the one that 'owns' this space (the HttpRequest and Response).

What you probably need to do is write an interceptor and configure the portal to use it. In the interceptor get the http response and set the headers. Remember that they need to be set before you write anything else to the response (otherwise they won't be considered) [....at least as much as I remember ...]

Disclaimer: since I'm new to this as well , you might double check with someone before you spend time on it ;)

[janole]

Tanks for the answer.
Looks like I have to dig futher on.

As you say the portlet itself can't control this behavior.
I was hoping that there was a way around, eg. by setting a property: resp.addProperty("portlet.expiration-cache","0");

In our applications we have to solve this use case:
- User Lisa logs on to the portal and access several "protected" pages.
- After a while she logs out and leave for lunch.
- "Hacker" Bob takes physical control over her computer, and use the back button in the browser.

If client caching not are turned off, he will be able to see localy cached pages in the browser, as long is he not posts or refresh's pages.
Since majorty of browsers support no-cache directive, this has been enough to solve this problem.

In our (and other) "secure" portal applications this problem has to be solved.


Regards
Jan Ole

[julien1]

so you are asking to have a property that would modify the pragma no cache of the entire response ?

[janole]

Yes, thats exactly what I'm asking for.


regards
Jan Ole

[julien1]

should that setting be by default instead ? would it make sense to be a default rather than an option ?

[janole]

Interesting question,

I think that

- when <expiration-cache> tag is set to 0 in portlet.xml, it would make sense that this is the default setting

- when expiration-cache > 0, I'm not sure. I guess you could still have this as default, forcing the cache mechanism in the portlet container to be used also when back and forward buttons are used. The drawback would be extra roundtrips for pages where the local cache still is valid. (There is also a META HTTP-EQUIV="EXPIRES" tag, but I'm not sure how well it works on different browsers). See http://www.i18nguy.com/markup/metatags.html for a list of useful metatags.

regards
jan ole

[jimmyed2001]

From your description is sounds like the problem is that the browser is caching the entire page. You can change this behavior by either

a) setting the 'expires' header in the theme jsp
b) setting the 'expires' property for the response objhect in the portlet

I'm not sure if b will work well, so try adding this as the first line after <% at the top of portal-core.sar\portal-core.war\nodesk\index.jsp

response.setHeader( "expires", "0" );

This will cause the browser to make a call to the server every time a page is requested.