tomcat security-constraint impact cache

Question

I have a problem in caching my application. when this code is added to web.xml of tomcat : ```

HTTPSOnly

/*

CONFIDENTIAL

``` I get this response : ``` Cache-Control private Date Tue, 18 Feb 2014 01:18:17 GMT Etag W/"200-1391558564593" Expires Thu, 01 Jan 1970 00:00:00 WET Server Apache-Coyote/1.1 ``` Without this code everything is fine : ``` Accept-Ranges bytes Cache-Control max-age=604800 Content-Length 1496 Content-Type text/css Date Tue, 18 Feb 2014 01:21:26 GMT Etag W/"1496-1391558561359" Expires Tue, 25 Feb 2014 01:21:27 GMT Last-Modified Wed, 05 Feb 2014 00:02:41 GMT Server Apache-Coyote/1.1 ``` Anyone can tell what cause the problem? and why this code change the cache-controle to private of my application. thanks a lot ``` Tomc…

Accepted Answer

According to the Oracle Java EE 6 tutorial, specifying a `user-data-constraint` of "CONFIDENTIAL" is to be used

when the application requires that data be transmitted so as to prevent other entities from observing the contents of the transmission.

For HTTP responses, that would mean ensuring that no proxies/caches along the way, from the server back to the client, would be able to cache that response and provide to any other requesting client. Thus the use of:

```
Cache-Control: private
```

While you might be tempted to use "INTEGRAL" instead of "CONFIDENTIAL", the same tutorial points out that many Java EE servers treat these two values identically.

If your application needs to allow caching, I suspect that you would need to remove the `<user-data-constraint>` element from your `web.xml` file.

Hope this helps!

tomcat security-constraint impact cache

Solution

Problem