0

What are the security implications that come with loading an image in dataURL format <img src="dataURL" />?

After signing into my website the browser loads an image in dataURL format for first time and take a few seconds to load. Later when I come back to the site and attempt to load the same image the image is loaded much faster. I'm assuming this is due to my browser caching the data URL. If this is true, how safe is that image stored in cache?

2

I'm assuming this is due to my browser caching the data URL.

Unlikely. There is no "key" on how such a data URL might be cached. The URL itself is already the content and there is no other shorter key to reference this content. This means that the browser cannot know if it should use the cached version of the data URL or use a fresh version.

But there is a caching key for the page which contains the data URL. This key is the URL of the page. Browsers cache based on this URL and depending on the headers in the response they might load a page directly from cache without asking (based on Expires HTTP header) or might ask the server for a fresh version and the server might just give a short notice that nothing has changed (HTTP status code 304) and the local version from cache can be used. In both cases the loading is faster.

If caching is considered safe or not depends on the content. Servers can control the caching behavior by setting the appropriate cache-control headers.

2

This depends an what you mean by "secure". If the provider of the website does not enforce an appropriate cache policy, your data is accessible even after logging out of that service.

Is that a problem? Well it depends. If it's confidential data, yes. On the other hand, even if the data was not be cached, you could store the data to disk while being logged in and use it later.

Either way you should prevent a third party from accessing any of your data by using encrypted storage (e.g. full disk encryption).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.