I am testing web application where some requests returns private data, which shouldn't be save in cache. Response contains headers:

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: -1

I found here https://stackoverflow.com/questions/30921598/what-does-expires-1-mean-in-nginx-location-directive that Expires: -1 means that these pages are never cached, so it seems ok.

But OWASP ASVS recommends:

Expires: Tue, 03 Jul 2001 06:00:00 GMT 
Last-Modified: {now} GMT 
Cache-Control: no-store, no-cache, must-revalidate, max-age=0 
Cache-Control: post-check=0, pre-check=0 
Pragma: no-cache

Are all there headers necessary and I should add them or it is ok right now?

  • These post-check and pre-check are IE specific headers from at least ten years ago. I cannot imagine they are still supported by anything! – iainpb Mar 6 '18 at 16:28
  • Pragma is a request header, so caching on server is not very useful😛 – Geir Emblemsvag Mar 6 '18 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.