4

Came across an application that uses below header to prevent caching.

cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
Expires: 0
Pragma: no-cache

As per standards, with this HTTP headers data should not be cached. When I checked in Firefox with about:cache in address bar, I found data cached in browser memory. However it was not cached in disk.

So can this be treated as security issue? If yes, what is the mitigation for preventing data to be cached in browser memory? Can this be mitigated using Cache-control: Private?

Improve this question
1
  • Well, in some way or the other the data will be cached in memory because of tabs. When you switch tab the browser has to remember the contents of the page so there's no way the browser can just throw that information away. The question is: Is it still there when you close the tab?
    – mroman
    Sep 8, 2016 at 15:17

1 Answer 1

Reset to default
2

It is really dificult to prevent a browser from caching anything at all. Even in private mode a browser uses caches, local databases and files on disk to speedup requests. All private mode does is promise it will be gone at the end of the session.

When you open developer tools and disable caching, it does not disable all caches either (AngularJS is known to cache problems).

Improve this answer
6
  • And, of course, if the operating system has a swap file, and it caches what the browser stores in memory, private mode data will still be present on the hard drive.
    – End Anti-Semitic Hate
    Sep 8, 2016 at 9:24
  • @RockPaperLizard Yes, it will also end up in the CPU caches, but that's somewhat beyond the point. These are OS level considerations, and normally we trust the OS.
    – Yorick de Wid
    Sep 8, 2016 at 9:30
  • Trust the OS? Default config of most OS (incl Windows) is to not wipe the swap file.
    – End Anti-Semitic Hate
    Sep 8, 2016 at 10:23
  • @RockPaperLizard In general yes we trust the OS, for guarding memory, protect processes from accessing each other, separate kernel from userland and so on. There is nothing a webdeveloper can do to force policies on OS level, hence the 'beyond the point' at least for this topic.
    – Yorick de Wid
    Sep 8, 2016 at 10:27
  • You're right. I reread the question and see it's from a webdev perspective. We all need to be aware of the system beyond the browser, but at the same time have to recognize that it is not trivial to enforce policies beyond that layer.
    – End Anti-Semitic Hate
    Sep 8, 2016 at 10:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .