Skip to main content
OCLC Support

Why EZproxy sends two cache-control headers on interstitial (302) and other EZproxy-generated pages

  1. Last updated
  2. Save as PDF

Applies to

  • EZproxy

Answer

EZproxy may send two Cache-Control headers on pages it generates directly (for example, the interstitial HTTP 302 redirect to the login page). This is expected behavior and is designed to prevent caching across a wide range of browsers and intermediary proxies. Although vulnerability scanners may flag this as “duplicate headers,” the directives are not conflicting, and the effective result is still "do not cache."


Example headers you may see

• Cache-Control: no-store, no-cache, must-revalidate 
• Cache-Control: post-check=0, pre-check=0

Can one header be suppressed or combined via config.txt?
If your config.txt does not contain any Cache-Control or HTTPHeader -server directives, the duplicate Cache-Control headers are being added by EZproxy itself. There is no supported config.txt option to suppress one of these built-in headers or merge them into a single line for EZproxy-generated pages.
Is a fix planned?
There are currently no plans to remove the legacy Cache-Control: post-check=0, pre-check=0 header from EZproxy interstitial pages.

Reason
EZproxy includes two Cache-Control header lines for compatibility:

• Modern cache prevention:Cache-Control: no-store, no-cache, must-revalidate is the standards-based instruction for modern browsers and proxies not to store the response.

• Legacy cache prevention:Cache-Control: post-check=0, pre-check=0 is a legacy directive historically used to prevent caching in older Microsoft/IE-era clients and some intermediary proxy implementations.

By sending both, EZproxy helps ensure that login and redirect pages are treated as non-cacheable in both modern and older environments.

Additional information

How to view the headers your server is sending

Page ID

68720