Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <tomcat-user@jakarta.apache.org>
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-2"
Content-Transfer-Encoding: quoted-printable
Subject: How to enable secured JSP to be cached by browser?
Date: Fri, 14 Feb 2003 12:18:05 +0100
Message-ID: <0FC256809F478F458D17066738450B3A11F240@sbk-wa.int.softbank.pl>
Thread-Topic: How to enable secured JSP to be cached by browser?
Thread-Index: AcLUCyFxKLqfzz/+EdewdQDAT2EJlgAAoDtQAAMiA2A=
From: "Szwajkajzer  Adam" <A.Szwajkajzer@softbank.pl>
To: <tomcat-user@jakarta.apache.org>

Hi all.
I'm using Tomcat 4.1.18 (in boundle with JBoss 3.0.5).
My application is configured to use declarative security (FORM based).
Here my problems start.
Each HTTP respons for secured JSP page gets amend by Tomcat.
Additional header Pragma, Cache-Control and Expires entries are inserted
to prevent the page to be locally cached.
I've found on that list it is performed by AuthenticatorBase class and =
was added=20
to prevent security vulnerability.

The problem is with form pages in following scenario:=20
User inserts data, submits form, server returns an application error.=20
User returns to form page but it is reread from server and of course =
it's empty.
(User gets angry while retyping all form data;)

Since the application is only used in intranet it would be acceptable to =
locally cache=20
secured JSP pages.
So, is it possible to switch off  no-cache/expires feature in Tomcat =
4.1.18?

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org