2

I heard about a security incident where someone had accidentally placed sensitive information inside a cached JSON file. I was wondering, for the purpose of containment, what is the best way to force clients to overwrite this file so that the sensitive information is no longer available.

Would something like a Cache-Control: no-cache, no-store, must-revalidate followed by a new definition of the same cached file result in the existing JSON file being overwritten.

Looking forward to ideas and suggestions. Thanks.

2

Would something like a Cache-Control: no-cache, no-store, must-revalidate followed by a new definition of the same cached file result in the existing JSON file being overwritten.

No, because, if it is in the browser cache, and still cacheable, the browser won't fetch it. It is possible to force cache-busting by loading the content in an iframe (i.e. not via ajax) then performing an explicit reload (not refresh). The initial load will come from the browser, but (in most cases) the subsequent reload will fetch from the origin. However this does explicitly mean that the cache entry will be removed. Depending on how the cache is implemented, it may simply be flagged as stale for later garbage collection. This does mean that the cached data won't be accessible to the browser.

To be sure of removing the data you would need to delete the entry (or entire cache) from the filesystem.

But the data would still be recoverable - deleting a file on most filesystems just removes it from the directory and makes the blocks available for re-use.

To be sure of removing the data you really need to overwrite it several times.

Oh, wait a moment, on some filesystems that just creates new versions of the file.

So, really you need to erase the data, smash the disk to pieces using a large hammer then melt it down to slag. What was the question again?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.