This OWASP recommendation says:

it is highly recommended to use the Cache-Control: no-cache="Set-Cookie, Set-Cookie2" directive, to allow web clients to cache everything except the session ID

But the mozilla docs say

The no-cache response directive indicates that the response can be stored in caches, but the response must be validated with the origin server before each reuse, even when the cache is disconnected from the origin server.

So no-cache can't actually prevent the caching of session cookies, can it?

1 Answer 1


I've checked RFC2068

cache-response-directive =
                          | "no-cache" [ "=" <"> 1#field-name <"> ]

When a directive appears without any 1#field-name parameter, the directive applies to the entire request or response. When such a directive appears with a 1#field-name parameter, it applies only to the named field or fields, and not to the rest of the request or response. This mechanism supports extensibility; implementations of future versions of the HTTP protocol may apply these directives to header fields not defined in HTTP/1.1.

So the OWASP recommendation (https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching) you have mentioned is about caching Set-cookie directive, but the Mozilla documentation (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control) is about caching generally and for all response.

So if you set Cache-Control: no-cache="Set-Cookie", the response can be cached, but without Set-Cookie headers. I found a similar discussion here.

But I did a test on my application, when there was a header Cache-Control: no-cache my session ID cookie was cached. I can find it in Firefox browser using URL about:cache to check cache details.

enter image description here

and in cache file:

enter image description here

But when setting Cache-Control: no-cache="Set-Cookie" there was no difference in my browser cache. I also found session ID cookie.

enter image description here

Generally no-cache directive when it is set in the response header Cache-Control: no-cache does not mean "don't cache". As you can see in mentioned documentation

no-cache allows caches to store a response but requires them to revalidate it before reuse. If the sense of "don't cache" that you want is actually "don't store", then no-store is the directive to use.

I suppose that this is the reason for such a browser behavior. But I'm not sure on this topic, if I'm wrong please correct me.

  • So it seems that the OWASP recommendation is wrong then, right? It's cached either way?
    – jacob
    Jun 26, 2022 at 18:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .