Take the 2-minute tour ×

From my experiences so far, I've concluded that the HTML5 Manifest scheme was really terribly designed.

My site serves a manifest file when a user is logged in. Unfortunately, when they log out, they can still access the cached protected materials. Can anyone think of a way to fix this?

share|improve this question
Is it just a web site, or a full blown web application? –  DisgruntledGoat Jun 30 '11 at 0:30
Eh, nothing huge. The cached part is two pages, a handful of JavaScript, CSS, and images. –  Chris Laplante Jun 30 '11 at 0:35
add comment

4 Answers

up vote 3 down vote accepted

A manifest file is designed to take a website offline and still be able to navigate. It essentially just tells the browser to download and keep that stuff in cache. If your adding secret stuff to the manifest and the user goes offline, he needs to be able to still access it - or whats the point of having a special logged-in-manifest-file if he has to be loggedin (therefor online)?

You could add javascript that checks if the user is online again and if he is, tries to validate the "login state" and redirects or removes the secret stuff from localstorage (if you would use localstorage to save the "secret" stuff and javascript to display it instead of a manifest file )

Lets say the secret stuff is an image and you are not using a manifest file, but just displaying images when the user is logged in and its crusial, the user cant view that image after logout, you would need to set the http headers to no-cache and cache-expire to some random date of the past, so that a normal user would see it anymore. Problem then is, that the image is downloaded everytime somebody visits the website..

share|improve this answer
You make some good points. They were given access to the materials in the first place, so I shouldn't care that they now have access to them offline. I've also taken your advice and am using JavaScript to wipe "expired" parts of the app when access offline and logged out. –  Chris Laplante Jun 30 '11 at 1:19
happy you found my answer helpful! –  japrescott Jul 2 '11 at 13:40
add comment

You need to approach the HTML5 Application Cache in a different way. It is not useful for caching server-side dynamically generated pages, especially those that require a login to reach. The Application Cache has no concept of logins, nor securing a page from somebody with a different/no login.

It is much more appropriate for an AJAX-based site, where all HTML/CSS/JavaScript is static and registered in the Application Cache, and data is instead fetched via AJAX then used to populate pages. If you need to cache data in the application for offline use, then use one of the offline data storage mechanisms such as Local Storage/Session Storage, or IndexedDB, for data.

You can then make your own judgement on how much data you want to cache offline, since there's no way to validate a login without making a call to the server that is naturally inaccessable whilst offline.

share|improve this answer
This is the approach I've now decided to take. All "login-sensitive" materials are fetched via Ajax. These requests will naturally fail when the user isn't logged in. Furthermore, by marking them as uncacheable in the manifest, I won't run into any problems. –  Chris Laplante Jun 30 '11 at 1:18
If there's something wrong with HTML5 Application Cache, it is that it can't be just welded on to traditionally-built server-generated websites. It seems that this confuses people even more than the touchy update mechanism. –  Stoive Jun 30 '11 at 1:46
add comment

What if when the user logs out or is not logged in they get a manifest with only network:*

share|improve this answer
The only problem I had with this approach was that the entire manifest would have to be re-downloaded each time the user logged in. But, it will have to do. Thanks for the suggestion! (Accepting your answer when it lets me) –  Chris Laplante Jun 30 '11 at 0:36
Damn. Chrome complains when the manifest changes between the logged in and logged out state: Application Cache Error event: Manifest changed during update, scheduling retry –  Chris Laplante Jun 30 '11 at 1:07
add comment

Just don't add path of resources, which should be protected, to the manifest file. It's the only resolution for now.

share|improve this answer
add comment

Your Answer


