How can I stop browsers caching my web page using HTTP 1.1 headers?

Although I have set Expires to a date in the past, and Cache-Control to no-store, no-cache, I still get one of my web pages cached.

Here are the HTTP headers sent to the browser:

Date: Tue, 02 Nov 2010 09:13:2开发者_运维问答3 GMT
Server: Apache/2.2.15 (el)
X-Powered-By: PHP/5.2.13
Set-Cookie: PHPSESSID=2luvb7b316lfc8ht570s1l1v84; path=/
Set-Cookie: Newsletter_Counter=17; expires=Wed, 02-Nov-2011 09:13:23 GMT; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 20
Connection: close
Content-Type: text/html; charset=UTF-8

Same behavior for FF 3.6, Safari and IE 8.

How do I get browsers to stop caching the page?

Browsers decide caching themselves. You can use a random GET parameter to force browsers not to cache, e.g.

http://www.foo.com/yourfile.zip?id=1234

The following headers have always worked well for me (for HTTP/1.1). You should not need Pragma: no-cache.

Cache-Control: no-cache
Expires: <some date in the past>
Vary: *

Try changing your Vary value to the asterisk from my example.

Per http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.44: "A Vary field value of "*" implies that a cache cannot determine from the request headers of a subsequent request whether this response is the appropriate representation."

Using Cache-Control: no-store should forbid any storage:

no-store
[…] If sent in a response, a cache MUST NOT store any part of either this response or the request that elicited it. This directive applies to both non- shared and shared caches. […]

You certainly seem to be doing the right things (but like a lot of people seem to assume that sending a 'Pragma: no-cache' response header has some effect on browser side caching - it should not).

What do you mean its getting cached? It will not (usually) be fetched again from the server if the user clicks on the 'back button' and was retrieved using a GET operation.