How can I disable cache for http headers?
<p>I am reading about <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Basic_access_authentication" rel="nofollow noreferrer">HTTP basic authentication</a>.  On the MDN website, it says:</p>
<blockquote>
<p>Because BA header has to be sent with each HTTP request, the web browser needs to cache the credentials for a reasonable period to avoid constant prompting user for the username and password. Caching policy differs between browsers. Microsoft Internet Explorer by default caches them for 15 minutes.</p>
</blockquote>
<p>However, <strong>after I told the <a href="https://www.getpostman.com/docs/settings" rel="nofollow noreferrer">chrome postman</a> to send a request without a cached header</strong> I still noticed the presence of an <code>authorization</code> field when I logged traffic at the server side:</p>
<pre><code>{ host: 'localhost:3000',
  connection: 'keep-alive',
  authorization: 'Basic YWRtaW46cGFzc3dvcmQ=',   // why?
  'user-agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36',
  'cache-control': 'no-cache',
  'postman-token': '7e458c2d-b11b-026d-809b-68a7cf3d5a37',
  ....
</code></pre>
<p>Then I also tried using just <strong>google chrome</strong>, but I again saw an <code>authorization</code> field:</p>
<pre><code>{ host: 'localhost:3000',
  connection: 'keep-alive',
  pragma: 'no-cache',
  'cache-control': 'no-cache',
  authorization: 'Basic YWRtaW46cGFzc3dvcmQ=', // again
  ....
</code></pre>
<p>Question 1: I disabled cache for both <strong>Chrome</strong> (I couldn't find the <strong>no-cached option</strong>, so I just selected <strong>&quot;disable cache&quot;</strong> in the chrome debugger) and <strong>postman</strong> (which has an option for &quot;no-cached header&quot;), but they still included the <code>authentication</code> header...why?  How can I prevent them from doing this?</p>
<p>Question 2: Same thing happened when I tried to make the client <strong>not</strong> to send back the <strong>Cookie</strong>, I even use the <em>clear cookie</em> functionality in chrome history... but I still see its presence in request header. I assume each header field is cached differently, so how can I manage the cookies?</p>
<p><strong>Opening an incognito window will make the browser forget about the authorization and cookie... but only once: subsequent tabs will have these headers.</strong></p>