Password-protected pages and public Internet stations

[Thomas Dowling]

 -----Original Message-----
From: Mike McGuire <mike at tcnet.org>
To: Multiple recipients of list <web4lib at library.berkeley.edu>
Date: Thursday, September 04, 1997 1:00 AM
Subject: Re: Password-protected pages and public Internet stations



>On Wed, 3 Sep 1997, Brian Stone wrote:
>
>> I don't know if this is the answer but you might try the Pragma html
>> header. Pragma forces a reload of the page each time it is accessed. It
>> works with netscape but not IE 3.0. We use it in our library for our
>> patron information pages. Keeps folks from seeing what others have
>> checked out.
>
>OK ... so what is 'Pragma'?
>

Pragma isn't HTML at all, but part of HTTP 1.0.

    ...When the no-cache directive is present in a request message, an
    application SHOULD forward the request toward the origin server even
    if it has a cached copy of what is being requested.

See section 14.32 of http://www.w3.org/Protocols/rfc2068/rfc2068  HTTP 1.1
prefers the more flexible Cache-Control header (section 14.9 of the same
document).

What it boils down to is that a well-behaved browser will always get a
document from the server rather than from its own cache or any intermediary
cache, if the HTTP server sends a header of "Pragma: no-cache" or if the
HEAD element of the HTML file includes:

<META HTTP-EQUIV="Pragma" CONTENT="no-cache">

I'm surprised (but only a little) that MSIE 3.x doesn't honor this.  4.0PP2
does, though.

For what its worth, this does not relate to the original question of forcing
browsers to "forget" a basic authentication password without starting a new
browser session.  To my knowledge, there's nothing you can do on the server
end to make that happen.  On the workstation end, you could get one of the
utilities that reboots a workstation after so many minutes of idle time.
The Web4Lib archives should turn up previous threads on that topic.

Thomas Dowling
OhioLINK - Ohio Library and Information Network
tdowling at ohiolink.edu