IIS 7.0 - IIS添加“私有”缓存控制，来自哪里 [英] IIS 7.0 - IIS adding "private" to cache-control, where is that coming from

问题描述

因为我们保护来自匿名用户的.PDF文件，所以我们有一个自定义处理程序，所以我们有一个条目

Because we protect .PDF files from anonymous users, we have a custom handler so we have an entry

我们还对http进行了更改通过IIS 7管理添加cache-control：no-cache，no-store的标头，它在system.webserver元素下创建web.config条目，如下所示：

We also made a change to the http headers to add "cache-control: no-cache,no-store" via IIS 7 management which creates web.config entries under system.webserver element as follows:

<httpProtocol>

  <customHeaders>
    <clear />
    <add name="cache-control" value="no-cache,no-store" />
  </customHeaders>

</httpProtocol>

当我在burpsuite会话中查看响应标头时，我看到.aspx页面：cache-control ：no-store，no-cache，no-store

When I review the Response headers in a burpsuite session, I see for .aspx pages: cache-control: no-store,no-cache,no-store

但是对于PDF页面：

Cache-Control ：私人，无缓存，无商店

Cache-Control: private,no-cache,no-store

我的目标是让所有东西都变成无缓存，无商店 。我不确定我错过了什么。 web.config中没有其他缓存设置。请告知如何从PDF页面删除私人和从其他所有地方删除额外的非商店。其他通过System.Web.StaticFileHandler的静态页面，它们也有no-store，no-cache，no-store。

My goal would be to get everything to just "no-cache, no-store". I am not sure what I am missing. There are no other cache settings in the web.config. Please advise on how to remove "private" from PDF pages and extra no-store from all else. Other static pages that go through the System.Web.StaticFileHandler, and they also have the "no-store,no-cache,no-store".

推荐答案

虽然这篇文章现在已经有几年了，但我想我会分享我的解决方案，这可能会节省几个小时的头脑。

Although this post is now a few years old, I thought I would share my solution that may save someone hours of head-scratching.

I有一个使用IIS的MVC 4站点设置，我的目标是让IIS通过使用< customHeaders> 部分将标题添加到某些文件（由位置定义）。我在< customHeaders> 部分中的缓存控制值被附加到cache-control：private的末尾，由IIS神奇地添加。

I have an MVC 4 site setup using IIS, and my aim was to have IIS add headers to certain files (defined by location), by using the <customHeaders> section. The 'cache-control' values I had in the <customHeaders> section were being appended to the end of 'cache-control: private', magically being added by IIS.

这是因为我的web.config中的 runAllManagedModulesForAllRequests 设置被设置为true

This was because of the runAllManagedModulesForAllRequests setting in my web.config being set to true

<system.webServer>
    <modules runAllManagedModulesForAllRequests="true">
    </modules>
</system.webServer>

此设置导致其中一个IIS模块（我不知道哪个）附加'缓存控制'标头到IIS请求的每个文件。

This setting was causing one of the IIS Modules (I don't know which) to append the 'cache-control' header to every file being requested from IIS.

所以解决方法是将其设置为false，并使用<$ c管理每个模块seperatley每个$ c> preCondition 属性。

So the solution is to set this to false, and manage each of your modules seperatley using the preCondition attribute on each.

早期版本的MVC需要 runAllManagedModulesForAllRequests 设置，因为无扩展路由没有它就行不通。这已经修复，更多细节在这里

The runAllManagedModulesForAllRequests setting was required by earlier versions of MVC because extensionless routing would not work without it. This has since been fixed, more details here

http://blogs.msdn.com/b/tmarq/archive /2010/04/01/asp-net-4-0-enables-routing-of-extensionless-urls-without-impacting-static-requests.aspx

有关使用 runAllManagedModulesForAllRequests

http://weblog.west-wind.com/posts/2012/Oct/25/Caveats-with -the-runAllManagedModulesForAllRequests-in-IIS-78

这篇关于IIS 7.0 - IIS添加“私有”缓存控制，来自哪里的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！