[TAP5-2275] Kaptcha setting invalid caching response headers

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.3.7
• Fix Version/s: 5.4
• Component/s: tapestry-kaptcha
• Labels: month-of-tapestry
• Assignee: Thiago Henrique De Paula Figueiredo
• Reporter: Ilya Obshadko
• Created: 23/Jan/14 23:22
• Updated: 08/Feb/14 18:42
• Resolved: 08/Feb/14 18:41

Description

please check this issue at Google Code:
https://code.google.com/p/kaptcha/issues/detail?id=72

There are two subsequent calls to setHeader() and second call is overriding the first one (that is already mentioned in code comments). Either support for addHeader () is needed in Response, or we need to inject HttpServletResponse directly.

response.setDateHeader("Expires", 0);
// Set standard HTTP/1.1 no-cache headers.
response.setHeader("Cache-Control", "no-store, no-cache, must-revalidate");
// Set IE extended HTTP/1.1 no-cache headers (use addHeader).
response.setHeader("Cache-Control", "post-check=0, pre-check=0");
// Set standard HTTP/1.0 no-cache header.
response.setHeader("Pragma", "no-cache");

Expires: 0 is still enough for all browsers except Firefox, which doesn't reload the image, and the whole component becomes unusable.