HTTP Expires header values “0” and “-1”

by

The problem is in how invalid Expires header processed by Internet Explorer (especially older versions).
IE uses Trident layout engine and WinINET API to process HTTP requests. As you may know Expires could be specified in HTTP header

Expires: 0

or in meta tag

<meta http-equiv="Expires" content="0">

In second case, Expires became part of the response content (not header content), so it will be processed by Trident and then propagated to WinINET:

If WinINET downloads a response with an invalid Expires header (e.g.
one that doesn’t contain a valid HTTPDATE value) and no other caching
directives, it will mark the document as having expired one hour ago.
Trident, however, has no such logic. If you specify an invalid time,
Trident grabs the current timestamp and uses that as the expiration.
Trident will also use the current timestamp if it encounters the
Pragma: no-cache directive. If the user tries to re-navigate to the
current document during same exact second that the HTTP/404 was
processed, the incorrectly-updated expiration of the existing cache
entry will result in it being treated as fresh for that request. If
the user hit the Refresh button or F5, the cache would be bypassed and
the 404 page would be shown.

In other words Expires: 0 not always leads to immediate resource expiration, therefore should be avoided and Expires: [some valid date in the past] should be used instead.

More Related Contents:

  1. Why is an OPTIONS request sent and can I disable it?
  2. Uses of content-disposition in an HTTP response header
  3. How to set HTTP headers (for cache-control)?
  4. What’s the difference between a POST and a PUT HTTP REQUEST?
  5. How to detect server-side whether cookies are disabled
  6. HTTP status code for update and delete?
  7. Why is it common to put CSRF prevention tokens in cookies?
  8. Which status code should I use for failed validations or invalid duplicates?
  9. Easy HTTP requests with gzip/deflate compression
  10. CORS request with Preflight and redirect: disallowed. Workarounds?
  11. PHP_SELF vs PATH_INFO vs SCRIPT_NAME vs REQUEST_URI
  12. Why does my web server software disallow PUT and DELETE requests?
  13. Send request to cURL with post data sourced from a file
  14. Difference between HTTP redirect codes
  15. Is a slash (“/”) equivalent to an encoded slash (“%2F”) in the path portion of an HTTP URL
  16. Whats Content-Type value within a HTTP-Request when uploading content?
  17. Save cookies between two curl requests
  18. Can I somehow do a synchronous HTTP request via NSURLSession in Swift
  19. How do I allow a PUT file request on Nginx server?
  20. Go client program generates a lot a sockets in TIME_WAIT state
  21. CURL Command Line URL Parameters
  22. Is REST DELETE really idempotent?
  23. What is a safe maximum length a segment in a URL path should be?
  24. Go http.Get, concurrency, and “Connection reset by peer”
  25. How to define the basic HTTP authentication using cURL correctly?
  26. Make a URL-encoded POST request using `http.NewRequest(…)`
  27. How to make XMLHttpRequest cross-domain withCredentials, HTTP Authorization (CORS)?
  28. complete list of mime-type file extension mapping
  29. Getting Basic Authentication to work with ColdFusion
  30. Keep-alive header clarification

Leave a Comment