Effect of CC directives on history lists

[mnot@…]

Several browser vendors do or will soon respect CC: no-store and CC: max-age=0, must-revalidate for the purposes of history lists, because they see storing some responses in the history list as a security concern (e.g., something with credit card numbers on it).

However, 2616 says that a cache and a history list are separate, and notes that history lists should not unnecessarily prevent users from viewing stale resources.

This is vague; the wording here implies that the history list has the same store as the cache, even though they are almost always implemented separately, as the history list needs to incorporate browser-side state as well as resource state.

This section needs to be revised, and furthermore some means of control over the history list needs to be provided; either

1. CC: no-store (and possibly other) directives apply to history lists as well, or
2. Some other history-specific directives need to be minted (out of scope for HTTPbis, but it can be discussed on-list)

See also:

​https://bugs.webkit.org/show_bug.cgi?id=26777 ​https://bugzilla.mozilla.org/show_bug.cgi?id=441751#c58 ​http://blogs.imeta.co.uk/JDeabill/archive/2008/07/14/303.aspx

[julian.reschke@…]

Proposed patch for part 6.

[julian.reschke@…]

From [766]:

Simplify discussion of history lists (see #197)

[mnot@…]

closed prematurely; reopen for review as part of -09 cycle.