Disable Browser Caching in JSF

最新推荐文章于 2018-03-09 18:02:14 发布

原创最新推荐文章于 2018-03-09 18:02:14 发布 · 187 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#JSF #Cache #Security #Servlet #XML

Oracle ADF 专栏收录该内容

4 篇文章

订阅专栏

本文介绍了一种通过实现JSF的PhaseListener接口来禁用浏览器缓存的方法，这对于在公共终端上运行的应用程序来说非常重要，因为可以避免敏感信息被非法访问。

Browser caching of page content has negative security implications when your application runs on shared terminals (like the public library). You can turn it off with this simple phase listener. Well, maybe. As some of the comments indicate, browsers are finicky, and of course, we never trust the browser, anyway, so using this technique is certainly not a security guarantee of any kind.


package my.util;  

import javax.faces.context.FacesContext;  
import javax.faces.event.PhaseEvent;  
import javax.faces.event.PhaseId;  
import javax.faces.event.PhaseListener;  
import javax.servlet.http.HttpServletResponse;  

public class CacheControlPhaseListener implements PhaseListener  
{  

    public PhaseId getPhaseId()  
     {  

        return PhaseId.RENDER_RESPONSE;  
     }   

    public void afterPhase(PhaseEvent event)  
    {  

    }   

     public void beforePhase(PhaseEvent event)  
     {  

         FacesContext facesContext = event.getFacesContext();  

        HttpServletResponse response = (HttpServletResponse) facesContext  
                 .getExternalContext().getResponse();  

         response.addHeader("Pragma", "no-cache");  

         response.addHeader("Cache-Control", "no-cache");  

        // Stronger according to blog comment below that references HTTP spec  

         response.addHeader("Cache-Control", "no-store");  

         response.addHeader("Cache-Control", "must-revalidate");  

        // some date in the past  

         response.addHeader("Expires", "Mon, 8 Aug 2006 10:00:00 GMT");  

     }  

 }

To register the phase listener, just add this to your faces-config.xml:


<lifecycle>  
   <phase-listener id="nocache">my.util.CacheControlPhaseListener</phase-listener>  
 </lifecycle>