CODEWITHSUNDEEP
pdfcachinginternet-explorer
Mike Davison
Mike Davison

Reputation: 59

Any reliable way to stop Internet Explorer (v7, 8) to stop caching PDF files?

An application I work on generates PDF documents and renders them in a browser window. Some of the data in the documents can be considered sensitive so we're exploring how to prevent the browser from caching the document contents. We're using the following Java code which prevents caching in Firefox but doesn't work in IE 8:

response.setHeader("Expires", "0");
response.setHeader("Pragma", "private");
response.setHeader("Cache-Control", "max-age=0, no-store");
response.setHeader("Content-disposition", "inline; filename= \"" + filename + "\"");
response.setContentLength(fbytes.length);

I'm wondering if anyone has had any luck manipulating headers to prevent IE from caching? Thanks in advance.

Upvotes: 2

Views: 3861

Answers (3)

EricLaw
EricLaw

Reputation: 57085

When you say "caching" you mean "Writing the document to the disk"?

No, there's no good way to do that because the Adobe PDF reader relies on the cache file in order to display the document.

Ordinarily, specifying "no-store" on a HTTPS document prevents it from downloading in IE at all, as discussed here: Link however since this document is being handled by the Adobe MIME handler, it seems that you're not hitting that problem.

The real question is "What's your threat model?" A bad guy with the ability to read the user's TIF typically has the ability to do other badness (e.g. install malware) so trying to keep the document off disk is a fairly futile exercise. This is especially true because modern operating systems use virtual memory (which writes memory pages to the hard disk in a swap file), which means that a bad guy with unrestricted ability to read the hard disk can recover the contents of memory anyway.

Upvotes: 4

Mark Macaulay
Mark Macaulay

Reputation: 1

The only reliable way I've found is to reference the pdf with a unique commandline parameter. We use guids (if in SQL you can get it from: SELECT newid()). Simply modify the requesting page calling for the pdf, if that is an a link consider doing the following: Syntax: <a href="{PDFfilename}?guid={UniqueID}">link</a>

Example: <a href="mypdf.pdf?guid=FA7848FB-414E-4C17-95E8-1921B333E1A0">Link</a>

This will require you to regen the requesting page everytime there is a modification to the pdf.

Upvotes: -1

Goutham
Goutham

Reputation: 80

Leaving the security apart, as the link exists in intranet. How can this be handled for IE6/IE8.

response.setHeader("Expires", "0");
response.setHeader("Pragma", "private");
response.setHeader("Cache-Control", "max-age=0, no-store");
response.setHeader("Content-disposition", "inline; filename= \"" + filename + "\"");
response.setContentLength(fbytes.length);

This piece of code did not work.

Upvotes: -1

Related Questions