{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Antiforgery/issues/116","repository_url":"https://api.github.com/repos/aspnet/Antiforgery","labels_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/116/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/116/comments","events_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/116/events","html_url":"https://github.com/aspnet/Antiforgery/issues/116","id":197628606,"number":116,"title":"Question: `no-store` versus `no-cache` for Antiforgery","user":{"login":"GuardRex","id":1622880,"avatar_url":"https://avatars.githubusercontent.com/u/1622880?v=3","gravatar_id":"","url":"https://api.github.com/users/GuardRex","html_url":"https://github.com/GuardRex","followers_url":"https://api.github.com/users/GuardRex/followers","following_url":"https://api.github.com/users/GuardRex/following{/other_user}","gists_url":"https://api.github.com/users/GuardRex/gists{/gist_id}","starred_url":"https://api.github.com/users/GuardRex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GuardRex/subscriptions","organizations_url":"https://api.github.com/users/GuardRex/orgs","repos_url":"https://api.github.com/users/GuardRex/repos","events_url":"https://api.github.com/users/GuardRex/events{/privacy}","received_events_url":"https://api.github.com/users/GuardRex/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-12-27T00:15:03Z","updated_at":"2016-12-27T00:21:26Z","closed_at":null,"body":"This question is related to how caching and Antiforgery was handled for https://github.com/aspnet/Antiforgery/issues/105.\r\n\r\nLooking at https://github.com/aspnet/Antiforgery/blob/3fc090e2fee47884af7968031e40876fcb6549ae/src/Microsoft.AspNetCore.Antiforgery/Internal/DefaultAntiforgery.cs#L70-L72 ...\r\n\r\n> Explicitly set the cache headers to 'no-cache'. This could override any user set value but this is fine as a response with antiforgery token must never be cached.\r\n\r\nand thus `SetDoNotCacheHeaders()` ...\r\nhttps://github.com/aspnet/Antiforgery/blob/3fc090e2fee47884af7968031e40876fcb6549ae/src/Microsoft.AspNetCore.Antiforgery/Internal/DefaultAntiforgery.cs#L370-L379\r\n\r\n@JunTaoLuo said [ref](https://github.com/aspnet/Antiforgery/issues/105#issuecomment-252769270) ...\r\n> The proposal is to disable caching when antiforgery is used regardless of whether cookies are being set. \r\n\r\n[RFC 7234](https://tools.ietf.org/html/rfc7234) doesn't guarantee that storage will not occur tho ...\r\n\r\n> 5.2.1.4.  no-cache\r\n> The \"no-cache\" request directive indicates that a cache MUST NOT use a stored response to satisfy the request without successful validation on the origin server.\r\n\r\nWondering: Why doesn't Antiforgery set `no-store` rather than `no-cache`?"},"comment":{"url":"https://api.github.com/repos/aspnet/Antiforgery/issues/comments/269251238","html_url":"https://github.com/aspnet/Antiforgery/issues/116#issuecomment-269251238","issue_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/116","id":269251238,"user":{"login":"shaunluttin","id":2066637,"avatar_url":"https://avatars.githubusercontent.com/u/2066637?v=3","gravatar_id":"","url":"https://api.github.com/users/shaunluttin","html_url":"https://github.com/shaunluttin","followers_url":"https://api.github.com/users/shaunluttin/followers","following_url":"https://api.github.com/users/shaunluttin/following{/other_user}","gists_url":"https://api.github.com/users/shaunluttin/gists{/gist_id}","starred_url":"https://api.github.com/users/shaunluttin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shaunluttin/subscriptions","organizations_url":"https://api.github.com/users/shaunluttin/orgs","repos_url":"https://api.github.com/users/shaunluttin/repos","events_url":"https://api.github.com/users/shaunluttin/events{/privacy}","received_events_url":"https://api.github.com/users/shaunluttin/received_events","type":"User","site_admin":false},"created_at":"2016-12-27T00:21:26Z","updated_at":"2016-12-27T00:21:26Z","body":"Setting `no-store` would help in cases when the user clicks the browser's back button."}}
{"actor":{"display_login":"shaunluttin"}}