How can I stop PDF docs from caching on my website?

[lanem]

I am working on a ASP.NET 2.0 web site that has some PDFs that users can
download. I'm using an HTTP module to see if the user has permission to view
the PDF before loading it. This all works great. The problem is that once
the PDF has been allowed through to the browser, it won't be denied to the
next user. So, if one user is allowed to see it and then a user who is not
allowed to see it uses the same browser, it comes through for them. If I
clear the cache on the browser, it works again. I think that once the PDF
doc comes through, the browser is caching it. How can I prevent this caching
from my web code? Thanks.

[Craig Deelsnyder]

On Tue, 19 Jul 2005 10:01:10 -0500, lanem
<la***@discussions.microsoft.com> wrote:

I am working on a ASP.NET 2.0 web site that has some PDFs that users can
download. I'm using an HTTP module to see if the user has permission to
view
the PDF before loading it. This all works great. The problem is that
once
the PDF has been allowed through to the browser, it won't be denied to
the
next user. So, if one user is allowed to see it and then a user who is
not
allowed to see it uses the same browser, it comes through for them. If I
clear the cache on the browser, it works again. I think that once the
PDF
doc comes through, the browser is caching it. How can I prevent this
caching
from my web code? Thanks.

The easiest way to avoid caching is to not link to the pdf file directly,
but create an aspx file that 'serves' the file to the user. Then you can
set headers, etc. appropriately to keep it out cache, or add a unique
querystring argument to the .aspx URL when you call it....

An example of streaming:
http://www.ondotnet.com/pub/a/dotnet...04/01/asp.html

--
Craig Deelsnyder
Microsoft MVP - ASP/ASP.NET

[lanem]

Thanks. That worked great. I can get it to work now using the streaming
stuff. I also figured out my previous problem, caching of the pdf pages. I
fixed this by putting a response.expires = -1 in my HTTP Module. So now,
both methods work. Which do you think is better and more secure? Using an
HTTP module or using this streaming solution? Thanks.

"Craig Deelsnyder" wrote:

On Tue, 19 Jul 2005 10:01:10 -0500, lanem
<la***@discussions.microsoft.com> wrote:

I am working on a ASP.NET 2.0 web site that has some PDFs that users can
download. I'm using an HTTP module to see if the user has permission to
view
the PDF before loading it. This all works great. The problem is that
once
the PDF has been allowed through to the browser, it won't be denied to
the
next user. So, if one user is allowed to see it and then a user who is
not
allowed to see it uses the same browser, it comes through for them. If I
clear the cache on the browser, it works again. I think that once the
PDF
doc comes through, the browser is caching it. How can I prevent this
caching
from my web code? Thanks.

The easiest way to avoid caching is to not link to the pdf file directly,
but create an aspx file that 'serves' the file to the user. Then you can
set headers, etc. appropriately to keep it out cache, or add a unique
querystring argument to the .aspx URL when you call it....

An example of streaming:
http://www.ondotnet.com/pub/a/dotnet...04/01/asp.html

--
Craig Deelsnyder
Microsoft MVP - ASP/ASP.NET