Cache-Control: private
Indicates that all or part of the response message is intended for a single user and MUST NOT be cached by a shared cache, such as a proxy server.
Looking at OWASP: Testing for Browser Cache Weakness
Browsers can store information for purposes of caching and history.
Caching is used to improve performance, so that previously displayed
information doesn't need to be downloaded again. History mechanisms
are used for user convenience, so the user can see exactly what they
saw at the time when the resource was retrieved. If sensitive
information is displayed to the user (such as their address, credit
card details, Social Security Number, or username), then this
information could be stored for purposes of caching or history, and
therefore retrievable through examining the browser's cache or by
simply pressing the browser's "Back" button.
OWASP says that, preferably the Cache-Control
is set to no-cache
. With Cache-Control: private
information might still be cached within the browser. This can be a security risk if your users tend to use shared computers. This is especially important for websites which send/display sensitive information such as credit card details.
Is it a security breach? no. Can it be a security risk? yes.
You should allign with the website's owner to see what kind of information is shown and stored and if the cache-control should be more restrictive.