An old questions, but adding an answer for modern times.

For sensitive responses, you should set the following header:

Cache-Control: no-store, must-revalidate

These days, you probably don't need to worry about the HTTP 1.0 Expires header. Pragma is only for requests, not responses.

To refresh the page just after session timeout (so that the login form appears), add this header:

Refresh: n + m

Where n is the number of seconds until the session times out and m is a small delay. In Java this is:

session.getMaxInactiveInterval() - ( System.currentTimeMillis() - session.getCreationTime() ) / 1000

An old question, but adding an answer for modern times.

For sensitive responses, you should set the following header:

Cache-Control: no-store, must-revalidate

These days, you probably don't need to worry about the HTTP 1.0 Expires header. Pragma is only for requests, not responses.

To refresh the page just after session timeout (so that the login form appears), add this header:

Refresh: n + m

Where n is the number of seconds until the session times out and m is a small delay. In Java this is:

session.getMaxInactiveInterval() - ( System.currentTimeMillis() - session.getCreationTime() ) / 1000

An old questions, but adding an answer for modern times.

For sensitive responses, you should set the following header:

Cache-Control: no-store, must-revalidate

As you are using SSL you don't need to worry about Proxy caching. Unless your users use Lynx, you don't need to worry about HTTP 1.0 Cache headers.

To refresh the page just after session timeout (so that the login form appears), add this header:

Refresh: n + m

Where n is the number of seconds until the session times out and m is a small delay. In Java this is:

session.getMaxInactiveInterval() - ( System.currentTimeMillis() - session.getCreationTime() ) / 1000

An old questions, but adding an answer for modern times.

For sensitive responses, you should set the following header:

Cache-Control: no-store, must-revalidate

These days, you probably don't need to worry about the HTTP 1.0 Expires header. Pragma is only for requests, not responses.

To refresh the page just after session timeout (so that the login form appears), add this header:

Refresh: n + m

Where n is the number of seconds until the session times out and m is a small delay. In Java this is:

session.getMaxInactiveInterval() - ( System.currentTimeMillis() - session.getCreationTime() ) / 1000