Prevent Browser Caching

If there are dynamic pages in your application, which also include sensitive information, you need to prevent caching. This can be done by making sure that the applications return the following HTTP security headers in HTTP responses.

Cache-Control:no-store, no-cache, must-revalidate

The following sections explain how you can configure these security headers to prevent caching in different types of applications used in WSO2 Identity Server.

Prevent for management console

You can enable these headers for the WSO2 Identity Server Management Console by adding the following configuration to the `<IS_HOME>/repository/conf/tomcat/carbon/WEB-INF/web.xml file.


Prevent for web applications

If your web application stored in the <IS_HOME>/repository/deployment/server/webapps/ directory, serves dynamic pages/content make sure that either URLBasedCachePreventionFilter or ContentTypeBasedCachePreventionFilter is available in the web.xml file of the particular application.

Note that the applications that are included in the /webapps directory by default in WSO2 Identity Server do not serve sensitive content that requires cache prevention. However, if you are adding a new application, you need to be mindful of this requirement.