Remove http header using java servlet api

Question

We are using IBM Websphere Application Server 6.1 and browser is Internet Explorer 8.

We have a java servlet which dynamically generates PDF and MS Word documents. On the first attempt some users are saying they are getting

"Internet Explorer was unable to open this site. The requested site is either unavailable or cannot be found. Please try again later."

As per Microsoft Support article id 323308
When you try to open a Microsoft Office document or a PDF document over HTTPS (SSL) IE fails with above error message. This issue occurs if the server sends a "Cache-control:no-store" header or sends a "Cache-control:no-cache" header. For IE8 Microsoft suggests to add registry entry on users Windows XP desktop. This is not very practical for us to do as we don't control our users desktops. This does not happen for IE9, Firefox, Chrome, etc.

As per PK20531 WAS 6.1 is adding Cache-Control: no-cache="set-cookie, set-cookie2" and Expires HTTP headers when there is cookie being set in the response.

Note - We are not setting the cookie in the servlet. The cookie is set by single sign-on software.

On the first attempt when the single sign-on (LTPA) cookie is being set and WAS is adding HTTP headers which IE browser does not like.

Does Java servlet api provide a way to remove http headers? Is there a technique to use Filter api to remove http headers?

Servlet Filter was able to remove the "Cache-contro:no-cache". But we decided to remove using IBM HTTP Server (apache) mod_headers which can also remove headers for individual virtual host. — Vineet Bhatia
– Vineet Bhatia, Commented Jul 30, 2011 at 2:15
see below for how we solved it. Write servlet filter (see oracle.com/technetwork/java/filters-137243.html) and set response header of "Cache-control:no-cache" — Vineet Bhatia
– Vineet Bhatia, Commented Oct 10, 2013 at 16:34
I have tried this response.setHeader("Cache-Control", "max-age=0");. But it's not making any difference I still see Cache-Control: no-cache — webdev
– webdev, Commented Oct 10, 2013 at 16:35

gutch · Accepted Answer · 2011-07-27 01:01:56Z

4

If you remove the Cache-Control header from the response, then you're not sending any instructions about caching and therefore the caching behavior would be unpredictable.

It would be better to set the header to something else, rather than remove it. Presumably you want to enable caching on the browser for your pages. So you could add these lines to your servlet to enable caching in the browser:

response.setHeader("Pragma", "cache");
response.setHeader("Cache-Control", "private, must-revalidate");

You could do this in a Filter too, because filters have access to the HTTP response object. But if you've written your own servlet then it's probably more efficient — and clearer — to do it in the servlet.

answered Jul 27, 2011 at 1:01

gutch

7,1593 gold badges38 silver badges54 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Vineet Bhatia Over a year ago

The app-server is setting Cache-Control: no-cache. I tried setting following in the servlet resp.addHeader("Cache-Control", "max-age=0"); and now http header is Cache-Control: max-age=0, no-cache.

Vineet Bhatia Over a year ago

Just realized should use setHeader() and not addHeader()

gutch Over a year ago

What happened when you used setHeader()? It makes sense that when you used addHeader() then you would get Cache-Control: max-age=0, no-cache — but I would have thought setHeader() is fine. What did you actually see?

Vineet Bhatia Over a year ago

With addHeader() got "Cache-Control: no-cache, max-age=0" and with setHeader() got "Cache-Control: max-age=0, no-cache" because WAS is adding the no-cache.

Alexander Pogrebnyak · Accepted Answer · 2011-07-27 00:02:48Z

1

It's all controllable by you. If you don't put it there, there will be nothing to remove.

answered Jul 27, 2011 at 0:02

Alexander Pogrebnyak

45.8k10 gold badges111 silver badges123 bronze badges

1 Comment

Vineet Bhatia Over a year ago

Would prefer to make a localized change to the application code rather than make a configuration change to the app-server which might impact other apps running there.

Collectives™ on Stack Overflow

Remove http header using java servlet api

2 Answers 2

4 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related