Confuse, Block and Confound the Browser’s Cache
May 24, 2010
Confuse the Cache & Block the Cache
Only one image is ever cached – the last image that was served.
Do this right…
- Set the response headers correctly to tell the browsers to not cache and not store your image.
- Request all images through a single URI that does not specify the image file type such as “/get-image/”.
- Block the typical human user’s ability to view the image via the URI by requiring the referrer to be the domain from which the image was served.
- Clear the cached URI by sending an empty image as the last image that is served into a hidden image tag.
And whenever someone does manage to click on an image URI sitting in their browser’s cache they will not see the image whenever their browser gets around to showing the image using the browser because the server will not serve the image because the referrer will not be set correctly thus requiring the user to forge some request headers and this will at-least raise the bar a bit higher and keep the typical civilian user from seeing your prized images or other content you don’t wish to share with everybody unless they are Authenticated and logged-in to your SaaS offering.
Response headers will have to be tweaked to ensure the browser will fetch from the server rather than using the cached image but again this is not all that difficult. Make sure you don’t use some funky trick like appending some random value to the end of the URI because this will not only bust the cache and hit the server, it will also result in every single image being potentially cached even if the Response headers are set to force the browser to not cache and not store each image.
Why bother with any of this anyway ?!?
If your site offers any kind of SaaS or other service your customers are paying for, for instance, then you might very well want to care about what ends-up in the browser’s cache.
The better method
Use Flash or Flex to fetch your images using AMF2 or AMF3 or some other method that forces the bits and bytes of each image to be transmitted in a format other than the native format most browsers know how to cache.
Use a socket client running in the SWF to make a dynamic connection with the server.
The SWF does not even have to be visible unless this is the desired use-case for your Flash talents.
If there is no Flash Player then fail-over to using the techniques listed above that don’t use flash otherwise use Flash and enjoy your ability to show your content to your end-user without allowing them to grab your content from their browser’s cache.