After a bit of investigation, turns out that Safari on iOS6 will cache POSTs that have either no Cache-Control headers or even “Cache-Control: max-age=0”.
The only way I’ve found of preventing this caching from happening at a global level rather than having to hack random querystrings onto the end of service calls is to set “Cache-Control: no-cache”.
So:
- No Cache-Control or Expires headers = iOS6 Safari will cache
- Cache-Control max-age=0 and an immediate Expires = iOS6 Safari will cache
- Cache-Control: no-cache = iOS6 Safari will NOT cache
I suspect that Apple is taking advantage of this from the HTTP spec in section 9.5 about POST:
Responses to this method are not cacheable, unless the response
includes appropriate Cache-Control or Expires header fields. However,
the 303 (See Other) response can be used to direct the user agent to
retrieve a cacheable resource.
So in theory you can cache POST responses…who knew. But no other browser maker has ever thought it would be a good idea until now. But that does NOT account for the caching when no Cache-Control or Expires headers are set, only when there are some set. So it must be a bug.
Below is what I use in the right bit of my Apache config to target the whole of my API because as it happens I don’t actually want to cache anything, even gets. What I don’t know is how to set this just for POSTs.
Header set Cache-Control "no-cache"
Update: Just noticed that I didn’t point out that it is only when the POST is the same, so change any of the POST data or URL and you’re fine. So you can as mentioned elsewhere just add some random data to the URL or a bit of POST data.
Update: You can limit the “no-cache” just to POSTs if you wish like this in Apache:
SetEnvIf Request_Method "POST" IS_POST
Header set Cache-Control "no-cache" env=IS_POST