IE not showing PDFs with caching disabled

I've been asked to implement a security requirement that we instruct browsers not to cache sensitive data. This is all fine for the ASPX content using the standard instructions:

        Response.Expires = -1;
        Response.Cache.SetCacheability(HttpCacheability.NoCache);
        Response.Cache.SetNoStore();

However when I set these headers for PDF downloads, IE8 won't show the PDF (haven't tried other IE versions yet, kinda moot, I need it working on all of them, even IEfreaking6). Seems to work in firefox 4 beta, but I haven't double checked that it's definitely not caching it. Here is the abridged version of the code I'm using to serve the PDFs:

        Response.Clear();
        Response.ClearHeaders();
        Response.ClearContent();
        Response.Buffer = true;

        //This stops the PDFs from being viewed :(
        //Response.Expires = -1;
        //Response.Cache.SetCacheability(HttpCacheability.NoCache);
        //Response.Cache.SetNoStore();

        Response.ContentType = mime;
        Response.AddHeader("Content-Disposition", disposition);

        Response.BinaryWrite(file);

        Response.End();

Where in the case of PDFs the mime type is set to:

       private const string mimeTypePDF = "application/pdf";

The disposition is set to:

       var disposition = String.Format("{0};filename=\"{1}\"", SendInline ? "inline" : "attachment", Path.GetFileName(filename));

I'm going to play-around a bit more, maybe forcing them to download as mimetype "application/octet-stream" might work, but that would stop the nice open PDF's in a new browser window from working.

Has anyone had any success with preventing IE from caching PDFs from the server side and successfully displaying them?

Just to give a clear example about what happens. In one scenario user's can select a bunch of reports from a list, these are compiled into a PDF and the PDF is shown in a new browser window. With the caching enabled the browser window opens, but remains res开发者_StackOverflow社区olutely blank.

---

I've had the same problem with IE a few years ago and let is cache since I didn't have a requirement to disallow it.

However, since users are free to save a PDF document once the browser shows it, how do you plan on prevent them from do that?

Not that this will solve your problem but when sending physical files you should Response.TransmitFile instead of BinaryWrite. It's much faster and more efficient in terms of memory utilization since you don't need to load the entire file in memory before sending it.

---

Looks like this issue has been resolved in IE9.

I can now successfully execute the following:

    Response.Expires = -1
    Response.Cache.SetNoStore()
    Response.AppendHeader("Pragma", "no-cache")
    Response.ContentType = "application/pdf"
    Response.BinaryWrite(myByteBuffer)
    Response.Flush()
    Response.Close()

Enjoy!

---

I'm going to say it's not currently possible, nothing I tried seemed to get it to work. Try and get your customers to use firefox instead! :)

---

I also believe it's a bug in Internet Explorer. I was setting the cache-control header to no-cache and having the same problem. Also note that in Internet Options > Advanced > Security there's a 'Do not save encrypted pages to disk' option that could affect it.

Removal of the cache-control header from the response sorted out my issue. I also then tried checking the above mentioned option, and it seemed to work even better for me. Iinstead of storing the PDF in %LocalAppData%\Microsoft\Windows\Temporary Internet Files, it actually caused IE8 to issue a dialog allowing me to choose where to save it (which is actually what I wanted in my case).

---

This issue of showing pdf (and other document types) in-browser with the use of the no-cache header has been filed as a bug to Microsoft: http://support.microsoft.com/kb/316431. When you try to open a document in this case, IE tries to read it from cache, but it isn't there.

Unfortunately, the folks at M$ said this "works as designed" and users should not use the no-cache header... go figure.