Best way to disable client caching

Question

I'm using a simple servlet filter that forces the browser to skip caching for some server resources:

    Cache-Control: private
    Pragma: 

This works fine in Internet Explorer but it doesn't works well with Firefox 3.0.10. I ended to write this code:

    Cache-Control: no-cache, no-store, must-revalidate, max-age=-1
    Pragma: no-cache, no-store
    Expires: -1 // -1 is the unix time, the client receives a date in 1969 :)
    Last-Modified: -1 // ditto

this forces firefox to cache nothing. What about other browsers? What about best practices on no caching headers that works on major browsers?

Answer 1

Drupal 6 does this (which works in every browser known by me):

• Expires: Sun, 19 Nov 1978 05:00:00 GMT
• Last-Modified: Fri, 12 Jun 2009 08:01:46 GMT (the actual modification date)
• Cache-Control: store, no-cache, must-revalidate, post-check=0, pre-check=0

No pragma header in this instance. I'm not sure why your example doesn't work, it might be the negative timestamps, this works on ~250.000 Drupal sites :)

Answer 2

Your initial solution did not work reliably because:

• Cache control is used to specify directives that MUST be obeyed by all caching mechanisms along the request/response chain. The only mechanisms that I know of are proxies, so user agents are not bound by it.
• The Pragma: header does not include a value. I'm not sure it's even legal - in terms of the HTTP protocol.