How to Prevent Browsers from Caching Static Contents using Spring MVC Framework

One of the mutual requirement inwards a secure Java spider web application is to disallow dorsum push of browser or invalid the session if the user striking the dorsum push of the browser. You mightiness possess got seen this deportment piece doing online banking or internet banking, almost all the banks don't allow you lot to role the browser's dorsum button. Your session gets terminated equally presently equally you lot striking the dorsum push together with you lot possess got to log inwards in i trial to a greater extent than to create whatever transaction. Btw, Have you lot e'er checked about province of affairs on your Java spider web application like, if you lot pressed the dorsum push of your browser afterward logging in, what happened? You volition discovery that browser takes you lot to the previous page. This happens because your browser unremarkably doesn't post about other GET request to the server. Instead, it views the spider web page from locally cached responses. This is called browser caching/HTTP caching, it could direct house non alone on a login page but on whatever page. This deportment is genuinely controlled past times the Cache-Control header of HTTP response.

Ideally you lot spider web application should redirect you lot to your after-logged-in-page (usually the Homepage) instead of showing the login shape page or exactly just invalidate the session if safety doesn't permit that. Anyway, inwards this article, I'll enjoin you lot how you lot tin instruct the browser to non cache the dynamic content inwards its local cache past times using the cache-control header.

If you lot are developing your Java Web application using Spring MVC framework (if you lot are not, together with thence you lot should) provides an slowly way to halt dynamic content caching at Browser.You postulate to declare a WebContentInterceptor edible bean together with define its properties inwards your servlet context file to forbid browsers from caching dynamic content.

The WebContentInterceptor is a Handler Interceptor inwards Spring MVC framework that checks the asking together with prepares the response. It checks for supported methods together with a required session together with applies the specified CacheControl builder. This interceptor is mainly intended for applying checks together with preparations to a laid of controllers mapped past times a HandlerMapping.

Here is a sample configuration you lot tin role to forbid browsers from caching dynamic content e.g. content generated past times Servlet, JSP, or whatever other dynamic technology:

<!--Prevent browsers from caching contents except for the static resources content-->     <mvc:interceptors>         <bean class="org.springframework.web.servlet.i18n.LocaleChangeInterceptor"               p:paramName="lang"/>         <mvc:interceptor>             <mvc:mapping path="/**"/>             <mvc:exclude-mapping path="/resources/**"/>             <bean id="webContentInterceptor"                    class="org.springframework.web.servlet.mvc.WebContentInterceptor">                 <property name="cacheSeconds" value="0"/>                 <property name="useExpiresHeader" value="true"/>                 <property name="useCacheControlHeader" value="true"/>                 <property name="useCacheControlNoStore" value="true"/>             </bean>         </mvc:interceptor>     </mvc:interceptors>

This configuration volition intercept all asking because mapping path is a wildcard which volition gibe all asking path, but together with thence all the asking which has /resources inwards the URL volition endure excluded. This agency you lot postulate to position your static resources e.g. HTML, JavaScript, images into that path.

That's all virtually how to disable local content caching using Spring framework. This is an of import characteristic from a safety indicate of sentiment which Spring MVC framework provides out-of-the-box. You tin likewise command together with customize the deportment past times setting the value which your application needs e.g. you lot tin specify the position out of seconds earlier cache expires. If you lot desire to larn to a greater extent than virtually safety inwards a spider web application, I propose you lot bring together Learn Spring Security Masterclass past times Eugen Paraschiv of Baeldung.

Further Reading
Introduction to Spring MVC
Spring Master Class - Beginner to Expert
How Spring MVC framework Works Internally
How to enable Spring Security inwards Java Web Application
How to exceed Spring Web Application Developer Certification
23 Spring MVC Interview Questions together with Answers
Spring together with Hibernate for Beginners

Thanks for reading this article, if you lot similar this article, together with thence delight portion amongst your friends together with colleagues. If you lot possess got whatever query or feedback together with thence delight driblet a comment together with I'll try to discovery an respond for you.

P.S. - If you lot desire to larn how to prepare RESTful Web Service using Spring MVC inwards depth, I propose you lot bring together the REST amongst Spring certification class past times Eugen Paraschiv. One of the best course of written report to larn REST amongst Spring MVC.