Browser caching of page content has negative security implications when your application runs on shared terminals (like the public library). You can turn it off with this simple phase listener. Well, maybe. As some of the comments indicate, browsers are finicky, and of course, we never trust the browser, anyway, so using this technique is certainly not a security guarantee of any kind.
package my.util;
import javax.faces.context.FacesContext;
import javax.faces.event.PhaseEvent;
import javax.faces.event.PhaseId;
import javax.faces.event.PhaseListener;
import javax.servlet.http.HttpServletResponse;
public class CacheControlPhaseListener implements PhaseListener
{
public PhaseId getPhaseId()
{
return PhaseId.RENDER_RESPONSE;
}
public void afterPhase(PhaseEvent event)
{
}
public void beforePhase(PhaseEvent event)
{
FacesContext facesContext = event.getFacesContext();
HttpServletResponse response = (HttpServletResponse) facesContext
.getExternalContext().getResponse();
response.addHeader("Pragma", "no-cache");
response.addHeader("Cache-Control", "no-cache");
// Stronger according to blog comment below that references HTTP spec
response.addHeader("Cache-Control", "no-store");
response.addHeader("Cache-Control", "must-revalidate");
// some date in the past
response.addHeader("Expires", "Mon, 8 Aug 2006 10:00:00 GMT");
}
}
To register the phase listener, just add this to your faces-config.xml:
<lifecycle>
<phase-listener id="nocache">my.util.CacheControlPhaseListener</phase-listener>
</lifecycle>
分享到:
相关推荐
注册表设置对应项 《开始菜单及相关设置》
Disable the Return Key in a TextBox
enable and disable "HOME" button in android 4.0.3 above the version 4.0.3,we should modify the frameworks detail is described in the Enable_Disable_Home.rar
蚁剑的能绕过disable_functions的插件,插件无法下载问题
此adb中无adb disable-verity命令,如果在cmd中输入以上命令会报 /system/bin/sh: disable-verity: not found 的错误。具体可看本人的文章 ”/system/bin/sh: disable-verity: not found 的解决方案“ 【使用方式】...
Utility to disable HOME KEY in Android Activity. As there are a lot questions about "how to disable home button in android?" on Stack Overflow, such as how to disable home button in android? Android ...
JavaScript
重新编译的支持adb disable-verity命令的adb,通常用于解锁system分区
后仿
reg文件zip包,used for disable ULPS。
支持adb disable-verity的最新adb工具包。
本文将为大家介绍交换机出现err-disable的原因及解决方法。
WordPress的插件:google字体插件-disable-google-fonts 解压后,请将目录名称:wordpress1,修改为:disable-google-fonts
td00036 华为以太网交换机vlan disable的功能和配置.doc
此adb工具包中包含了adb disable-verity命令,这里免费提供给大家使用,具体可看本人的文章 ”/system/bin/sh: disable-verity: not found 的解决方案“ 【使用方式】 platform-tools解压后即可使用。在cmd中通过cd...
adb驱动带disable-verity功能,不用添加环境变量,直接双击bat脚本启动,甚至更为小白设计了直接解锁system锁的bat,双击运行直接解锁
针对宝塔的RASP及其disable_functions的绕过1