How to prevent browser page caching in Rails

Question

Ubuntu → Apache → Phusion Passenger → Rails 2.3.

The main part of my site reacts to your clicks. So, if you click on a link, it will send you on to the destination, and instantly regenerate your page.

But, if you hit the back button, you don't see the new page. Unfortunately, it's not showing up without a manual refresh; it appears the browser is caching it. I want to make sure the browser does not cache the page.

Separately, I do want to set far-future expiration dates for all my static assets.

What's the best way to solve this? Should I solve this in Ruby on Rails? Apache? JavaScript?

Alas. Neither of these suggestions forced the behavior I'm looking for.

Maybe there's a JavaScript answer? I could have Ruby on Rails write out a timestamp in a comment, and then have the JavaScript code check to see if the times are within five seconds (or whatever works). If yes, then fine, but if no, then reload the page?

Do you think this would work?

What is the context of the first line? Your site? Something in Ubuntu? What is "Phusion Passenger"? — Peter Mortensen
– Peter Mortensen, Commented May 10, 2022 at 13:44
Phusion Passenger is an app server. It was pretty popular back then, I don't know if it's still widely used. — Jason Butler
– Jason Butler, Commented May 10, 2022 at 17:35

Peter Mortensen · Accepted Answer · 2022-05-10 13:47:27Z

347

I finally figured this out - http://blog.serendeputy.com/posts/how-to-prevent-browsers-from-caching-a-page-in-rails/ in application_controller.rb.

After Ruby on Rails 5:

class ApplicationController < ActionController::Base

  before_action :set_cache_headers

  private

  def set_cache_headers
    response.headers["Cache-Control"] = "no-cache, no-store"
    response.headers["Pragma"] = "no-cache"
    response.headers["Expires"] = "Mon, 01 Jan 1990 00:00:00 GMT"
  end
end

Ruby on Rails 4 and older versions:

class ApplicationController < ActionController::Base

  before_filter :set_cache_headers

  private

  def set_cache_headers
    response.headers["Cache-Control"] = "no-cache, no-store"
    response.headers["Pragma"] = "no-cache"
    response.headers["Expires"] = "Mon, 01 Jan 1990 00:00:00 GMT"
  end
end

edited May 10, 2022 at 13:47

Peter Mortensen

31.3k22 gold badges110 silver badges134 bronze badges

answered Apr 14, 2009 at 17:40

Jason Butler

5,6494 gold badges25 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

10 Comments

CafeHey Over a year ago

Should this be wrapped in a "if request.xhr?" so it only gets set on ajax refreshes but the normal pages do not?

gaqzi Over a year ago

You only really need Cache-Control: no-store as long as the browser is compliant with HTTP 1.1. Section 14.9.2 What May be Stored by Caches

Jan Hettich Over a year ago

Jan 1, 1990, was a Monday!

Thorin Over a year ago

Its not working for me I have add the same code in application_controller.rb and after logout I am able to see the last page by back button. Please guide me where I am wrong?

furiabhavesh Over a year ago

Will this also NOT cache JS and CSS in rails app ? Will JS and CSS be loaded from server for each request ?

|

Peter Mortensen · Accepted Answer · 2022-05-10 13:52:00Z

16

Use:

expires_now()

expires_now()

edited May 10, 2022 at 13:52

Peter Mortensen

31.3k22 gold badges110 silver badges134 bronze badges

answered Jul 5, 2011 at 9:57

Sacre

1771 silver badge2 bronze badges

2 Comments

Daniel Rikowski Over a year ago

expires_now only sends the no-cache header. Depending on the browser this might not be enough. (For example Firefox wants a no-store for non-HTTPS connections: developer.mozilla.org/en/docs/Using_Firefox_1.5_caching )

Andrew Smith Over a year ago

Agreed, this is not a valid solution, tested with Rails 5.2 and Chrome 77. no-store is also needed.

Peter Mortensen · Accepted Answer · 2022-05-10 13:45:59Z

3

I have used this line with some success in the controller. It works in Safari and Internet Explorer, but I haven't seen it work with Firefox.

response.headers["Expires"] = "#{1.year.ago}"

For your second point, if you use the Ruby on Rails helper methods like

stylesheet_link_tag

and leave the default settings on your web server, the assets are typically cached pretty well.

edited May 10, 2022 at 13:45

Peter Mortensen

31.3k22 gold badges110 silver badges134 bronze badges

answered Apr 2, 2009 at 21:29

erik

6,4363 gold badges38 silver badges36 bronze badges

2 Comments

Archonic Over a year ago

1.year.ago is unnecessary overhead. Just pick some arbitrary time in the past like Fri, 01 Jan 1990 00:00:00 GMT

Thomas R. Koll Over a year ago

@Archonic 1 jan 1990 was a Monday!

Peter Mortensen · Accepted Answer · 2022-05-10 13:49:52Z

1

The cleaner way would be to write Rack middleware, which changes the Cache-Control header based on some logic (for example, only for application/xml mime-type).

Or, for an uglier, but still working approach, one could change the ActionDispatch::Response::DEFAULT_CACHE_CONTROL constant to 'no-cache'.

Of course, if the controller and/or action granularity is required, then it's better to do this in the controller.

edited May 10, 2022 at 13:49

Peter Mortensen

31.3k22 gold badges110 silver badges134 bronze badges

answered Nov 7, 2010 at 20:03

Roman

13.1k4 gold badges50 silver badges63 bronze badges

Comments

Peter Mortensen · Accepted Answer · 2022-05-10 13:53:37Z

1

Point of note: You can't conditionally clear the cache (like if a before_filter only calls reset_cache if the user's already been there). You need to unconditionally clear the cache, because the browser won't make a new request just to see if this time it needs to reload, even though it didn't need to last time.

Example:

before_filter :reset_cache, if: :user_completed_demographics?

won't work to prevent users from coming back after they've been there, since the browser uses the original cache headers on the Back button.

before_filter :reset_cache

will work, however (after refreshing the page and clearing the cache from before you added this, obviously), since, on the first request, the browser will get the no-cache, no-store, ... and apply it to future page loads.

edited May 10, 2022 at 13:53

Peter Mortensen

31.3k22 gold badges110 silver badges134 bronze badges

answered Feb 20, 2016 at 17:25

Josh Grosso

2,1242 gold badges15 silver badges33 bronze badges

Comments

Peter Mortensen · Accepted Answer · 2022-05-10 14:08:37Z

0

`no_cache_control` Gem.

If you need to do this for all responses, e.g., to pass a penetration test (Burp Suite, Detectify, etc.), you can install this Gem on Ruby on Rails 4+ in order to add the following headers to all responses:

Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: -1

It works like a charm and is really the right way to go for secure, HTTPS web applications that require authentication to do anything.

edited May 10, 2022 at 14:08

Peter Mortensen

31.3k22 gold badges110 silver badges134 bronze badges

answered Sep 18, 2019 at 19:35

Joshua Pinter

48k23 gold badges262 silver badges258 bronze badges

Collectives™ on Stack Overflow

How to prevent browser page caching in Rails

6 Answers 6

10 Comments

2 Comments

2 Comments

Comments

Comments

`no_cache_control` Gem.

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

10 Comments

2 Comments

2 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related