Skip to main content
Information Security

Return to Question

fix typo
Source Link
Matthew
Matthew
  • 27.4k
  • 7
  • 92
  • 104

A web page accepts user name and password data within an HTTP POST request. This POST request actually shows up as an entry in the browsers history. After user logout from the application and ‘navigate’ back to this entry using back button, the browser notices that the content has already expired so it prompts with information that the content has expired and asks to resubmit the request to get the ‘updated’ version of that page from the server. Once

Once user click the retry/refresh button then this forms data is passed back to server and treated as a normal login request. Thereby allowing user to login to application using cached credentailscredentials of previously logged-out user. What are the possible ways to prevent caching of input request data ?

A web page accepts user name and password data within an HTTP POST request. This POST request actually shows up as an entry in the browsers history. After user logout from the application and ‘navigate’ back to this entry using back button, the browser notices that the content has already expired so it prompts with information that the content has expired and asks to resubmit the request to get the ‘updated’ version of that page from the server. Once user click the retry/refresh button then this forms data is passed back to server and treated as a normal login request. Thereby allowing user to login to application using cached credentails of previously logged-out user. What are the possible ways to prevent caching of input request data ?

A web page accepts user name and password data within an HTTP POST request. This POST request actually shows up as an entry in the browsers history. After user logout from the application and ‘navigate’ back to this entry using back button, the browser notices that the content has already expired so it prompts with information that the content has expired and asks to resubmit the request to get the ‘updated’ version of that page from the server.

Once user click the retry/refresh button then this forms data is passed back to server and treated as a normal login request. Thereby allowing user to login to application using cached credentials of previously logged-out user. What are the possible ways to prevent caching of input request data ?

Tweeted twitter.com/#!/StackSecurity/status/256363910033178624
Source Link
wxyz
wxyz
  • 51
  • 1
  • 2

How to disable caching of form data?

A web page accepts user name and password data within an HTTP POST request. This POST request actually shows up as an entry in the browsers history. After user logout from the application and ‘navigate’ back to this entry using back button, the browser notices that the content has already expired so it prompts with information that the content has expired and asks to resubmit the request to get the ‘updated’ version of that page from the server. Once user click the retry/refresh button then this forms data is passed back to server and treated as a normal login request. Thereby allowing user to login to application using cached credentails of previously logged-out user. What are the possible ways to prevent caching of input request data ?