TLDR: 302, 307 and Error pages are being cached. Need to force a refresh of the content.
Long version: I've setup a very minimal squid instance running on a gateway which shouldn't not cache ANYTHING but needs to be solely used as a domain based web filter. I'm using another application which redirects un-authenticated users to the proxy which then uses the deny_info option redirects any non-whitelisted request to the login page. After the user has authenticated the firewall rule gets placed so they no longer get sent to the proxy.
The problem is that when a user hits a website (xkcd.com) they are unauthenticated so they get redirected via the firewall:
iptables -A unknown-user -t nat -p tcp --dport 80 -j REDIRECT --to-port 39135
to the proxy at this point squid redirects the user to the login page using a 302 (i've also tried 307, and i've also make sure the headers are set to no-cache and/or no-store for Cache-Control and Pragma). Then when the user logs into the system they get firewall rule which no longer directs them to the squid proxy. But if they go to xkcd.com again they will have the original redirection page cached and will once again get the login page.
Any idea how to force these redirects to NOT be cached by the browser? Perhaps this is a problem w/ the browsers and not squid, but not sure how to get around it.
Full squid config below.
#
# Recommended minimum configuration:
#
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl localnet src 192.168.182.0/23 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl https port 443
acl http port 80
acl CONNECT method CONNECT
#
# Disable Cache
#
cache deny all
via off
negative_ttl 0 seconds
refresh_all_ims on
#error_default_language en
# Allow manager access only from localhost
http_access allow manager localhost
http_access deny manager
# Deny access to anything other then http
http_access deny !http
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !https
visible_hostname gate.ovatn.net
# Disable memory pooling
memory_pools off
# Never use neigh cache objects for cgi-bin scripts
hierarchy_stoplist cgi-bin ?
#
# URL rewrite Test Settings
#
#acl whitelist dstdomain "/etc/squid/domains-pre.lst"
#url_rewrite_program /usr/lib/squid/redirector
#url_rewrite_access allow !whitelist
#url_rewrite_children 5 startup=0 idle=1 concurrency=0
#http_access allow all
#
# Deny Info Error Test
#
acl whitelist dstdomain "/etc/squid/domains-pre.lst"
deny_info http://login.domain.com/ whitelist
#deny_info ERR_ACCESS_DENIED whitelist
http_access deny !whitelist
http_access allow whitelist
http_port 39135 transparent
## Debug Values
access_log /var/log/squid/access-pre.log
cache_log /var/log/squid/cache-pre.log
# Production Values
#access_log /dev/null
#cache_log /dev/null
# Set PID file
pid_filename /var/run/gatekeeper-pre.pid
SOLUTION:
I believe I might have found a solution to this. After days and days trying to figure it out, only through a random stumble I found
client_persistent_connections off
server_persistent_connections off
This did the trick. So it wasn't so much cache as it was a single persistent connection messing things up. W000T!
