Default value for browser cache properties conflicts with aggressive caching proxies and load balancers

• Type: Story
• Status: Closed
• Priority: Trivial
• Resolution: Completed
• Affects Version/s: 7.0.X EE, Master
• Fix Version/s: 7.0.X, Master
• Component/s: Frontend Infrastructure
• Labels:
  • 7010-sp-pending
  • ee-ts
  • pt-app-security-review
• Branch Version/s:
  7.0.x
• Backported to Branch:
  Committed
• Git Pull Request: https://github.com/jbalsas/liferay-portal/pull/809

The following portal properties both default to false.

    #
    # Set this to true if you want the portal to force the browser cache to be
    # disabled. It will only disable the cache for the rendered HTML response.
    # It will not have an impact on static content or other resources.
    #
    browser.cache.disabled=false

    #
    # Set this true if you want to disable the cache for authenticated users.
    # This property is not read when the property
    # "browser.cache.signed.in.disabled" is true. This is useful to ensure that
    # authenticated users cannot go to the sign in page by clicking on the back
    # button in their browsers.
    #
    browser.cache.signed.in.disabled=false

This can cause problems for aggressive caching proxies that prefer to cache content whenever the cache control headers are missing. These default values also run counter to the overall goal for Liferay to assist with personalization (including for guest users), as the content would have already been cached by these proxies and thus all guest users see the same content.

To avoid the problem where simply switching the header may be too late, as the content has already been cached, we should change the default values to true and allow end users in future releases to switch it to false.