Came across an application that uses below header to prevent caching.

cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
Expires: 0
Pragma: no-cache

As per standards, with this HTTP headers data should not be cached. When I checked in Firefox with about:cache in address bar, I found data cached in browser memory. However it was not cached in disk.

So can this be treated as security issue? If yes, what is the mitigation for preventing data to be cached in browser memory? Can this be mitigated using Cache-control: Private?

  • Well, in some way or the other the data will be cached in memory because of tabs. When you switch tab the browser has to remember the contents of the page so there's no way the browser can just throw that information away. The question is: Is it still there when you close the tab? – mroman Sep 8 '16 at 15:17

It is really dificult to prevent a browser from caching anything at all. Even in private mode a browser uses caches, local databases and files on disk to speedup requests. All private mode does is promise it will be gone at the end of the session.

When you open developer tools and disable caching, it does not disable all caches either (AngularJS is known to cache problems).

  • And, of course, if the operating system has a swap file, and it caches what the browser stores in memory, private mode data will still be present on the hard drive. – RockPaperLizard Sep 8 '16 at 9:24
  • @RockPaperLizard Yes, it will also end up in the CPU caches, but that's somewhat beyond the point. These are OS level considerations, and normally we trust the OS. – Yorick de Wid Sep 8 '16 at 9:30
  • Trust the OS? Default config of most OS (incl Windows) is to not wipe the swap file. – RockPaperLizard Sep 8 '16 at 10:23
  • @RockPaperLizard In general yes we trust the OS, for guarding memory, protect processes from accessing each other, separate kernel from userland and so on. There is nothing a webdeveloper can do to force policies on OS level, hence the 'beyond the point' at least for this topic. – Yorick de Wid Sep 8 '16 at 10:27
  • You're right. I reread the question and see it's from a webdev perspective. We all need to be aware of the system beyond the browser, but at the same time have to recognize that it is not trivial to enforce policies beyond that layer. – RockPaperLizard Sep 8 '16 at 10:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.