Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I read in an article that if the request is authenticated or secure (i.e., HTTPS), it won’t be cached.
But in https, burp has reported an issue stating http response is as follows:
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
SN: SJVPROD1
Date: Thu, 15 May 2014 20:29:30 GMT
Content-Length: 229
Is this a security breach?
Cache-Control: private
Indicates that all or part of the response message is intended for a single user and MUST NOT be cached by a shared cache, such as a proxy server.
Looking at OWASP: Testing for Browser Cache Weakness
Browsers can store information for purposes of caching and history. Caching is used to improve performance, so that previously displayed information doesn't need to be downloaded again. History mechanisms are used for user convenience, so the user can see exactly what they saw at the time when the resource was retrieved. If sensitive information is displayed to the user (such as their address, credit card details, Social Security Number, or username), then this information could be stored for purposes of caching or history, and therefore retrievable through examining the browser's cache or by simply pressing the browser's "Back" button.
OWASP says that, preferably the Cache-Control is set to no-cache. With Cache-Control: private information might still be cached within the browser. This can be a security risk if your users tend to use shared computers. This is especially important for websites which send/display sensitive information such as credit card details.
Is it a security breach? no. Can it be a security risk? yes.
You should allign with the website's owner to see what kind of information is shown and stored and if the cache-control should be more restrictive.
