CIBA: Pragma: no-cache

[Takahiko Kawasaki]

Examples of responses from the server (e.g. the example in 7.3. Successful Authentication Request Acknowledgement) include Cache-Control: no-store but don't include Pragma: no-cache. This is different from examples in RFC 6749. Is there any reason for this difference?

[Dave Tonge]

I doubt there is any reason - we can quickly update

[Brian Campbell]

I suspect the real reason is that when the examples were done in CIBA, they were started by copying and pasting a <figure ... > from somewhere that didn't have Pragma: no-cache in the response.

A better answer IMHO is that Pragma: no-cache is not actually defined to have meaning as an HTTP response header - see the note at the end of the section https://tools.ietf.org/html/rfc7234#section-5.4 - and I'd prefer not to propagate it by way of inclusion in examples.

A more nuanced answer is that there are or were apparently transparent caching proxies or something that aren't HTTP 1.1 compliant and do consider the Pragma: no-cache as a no cache signal. So that's maybe why it keeps showing up. Some more can be seen in this old thread: http://lists.openid.net/pipermail/openid-specs-ab/Week-of-Mon-20150223/005320.html

But examples are non-normative and them not having a Pragma: no-cache in the response headers doesn't preclude your (or any) implementation from include it, if for whatever reason doing so is deemed appropriate.

[Takahiko Kawasaki]

Brian, thank you for your informative comment.

[Brian Campbell]

Reasoning explained (more or less) with no changes needed to the document.