Hi,
A have an asp.net (C#) intranet based web app that has a bunch of webforms and I need to know whether the page content is cached on the end users machine....
User1 goes to webform1 and fills in some basic information (Customer Ref Number, Name, etc) and submits the webform.
User2 then goes to webform2 which displays the Customer Ref, Name, etc.
User2 then fills in additional [sensitive] information (Contract Number, Contract value, etc) and submits the webform.
User3 then goes to webform3 which displays all of the information entered above.
User3 then fills in additional information...
And the process continues with more users adding more information to other webforms.
The concern from our internal IT Compliance folks is that the page content may be cached on the users machines, thus exposing security risks around the confidentiality of sensitive data.
The thing is that I do not know whether page content is being cached (we certainly dont put anything regarding caching in the code pages).
If content is being cached, can this be disabled, and if so, what things need to be taken into consideration?
My concern is would functionality and/or performance of the webapp be affected if we were to disable client side caching? Also, it may be worth mentioning that the webforms use AJAX - would this still work if caching is disabled?
Also, we use Master Pages.
Thanks
Gary
Loading
Gary KingPosted May 31, 2012, 5:00 AM
I dont want any part of the page/form saved on the user's machine.
Having done some further investigations, I tried using the following (we only use Internet Explorer):
Response.Cache.SetCacheability(HttpCacheability.NoCache);
The webforms are part of a workflow application and to add my initial description....
1. User1 needs to create a new contract item (webform). They go to a Sharepoint portal and click on "Create New Contract". This then opens up the 1st form - let's say the url is Form1.aspx?SN=1234
2. User1 then fills in the webform details and clicks "Submit" which saves the form data to the database before redirecting the user to a simple confirmation page (Form1_Submitted.aspx). It is at the point of form submission that the contract item is then progressed to the next stage of the workflow process.
3. User1 then closes the Internet Explorer window.
4. User2 will see that there is an item in their Sharepoint worklist.
5. User2 clicks on the item which then opens the next webform in a new IE window - let's say Form2.aspx?SN=8263
6. Form2 displays the data that was previously entered by User1
7. User2 then fills in additional data, clicks "Submit" which saves the form data to the database before redirecting the user to a simple confirmation page (Form2_Submitted.aspx). Again, the contract item is then progressed to the next stage of the workflow process.
8. If User2 then hits the Internet Explorer "Back" button, they get the regular "Webpage has expired...." message.
9. If the user then refreshes the page (F5), then the form appears with the data that was entered by User1, but not the data entered by User2.
You may think that there is nothing unusual about this behaviour....and that what is happening is that the page is being reloaded from the server. BUT I dont think this is true....
If after User2 submits the form, he then opens a new IE window and copies the url (Form2.aspx?SN=8263), then the form will open, without any data, but with an error message stating that the item cannot be found. The reason for this is that the SN is unique to a contract item at a single point in the process. Notice that despite User1 and User2 are working on the same contract item, the SN value is different, because they are working on the contract at different stages of the process. The SN is there to identify the contract item to the backend workflow application (K2 Blackpearl).
What I am 99.9% sure of is that by hitting F5, the page is not being reloaded from the server - if it was being reloaded, then the user would see an empty form with an error message.
So, when the user does hit Back and F5 how is it that Internet Explorer displays the form data?
A couple of theories that I have:
1. Despite using SetCacheability, the page is still being written to the user's local disk
2. That the page is being held in memory on the user's machine (if this is the case, then maybe it could also be written to the page file, therefore writting it to the user's disk)
Whatever is happening, it certainly doesn't look to be correct to me.
What I need to be 100% percent sure of is that absolutey nothing in the terms of data remains on the user's machine.
As a sidenote, please do not read too much into the fact that part of the overall application uses Sharepoint. This is purely for the purpose of managing the contract items as they progress through the workflow process which utilizes K2 Blackpearl. My concern is with the webforms only.
Sandeep PantPosted May 31, 2012, 3:55 AM
directive.
And i think the page does not cached until you have explicitly specified it.