Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [caching]

Cache is a component that transparently stores data so that future requests for that data can be served faster. The data that is stored within a cache might be values that have been computed earlier or duplicates of original values that are stored elsewhere. If requested data is contained in the cache (cache hit), this request can be served by simply reading the cache, which is comparatively faster.

1
vote
2answers
73 views

Can I alter the DNS cache on my Computer?

Can I alter the DNS cache of my computer. When I search online it only shows result to flush DNS cache and not how to alter it. The DNS cache saved on Windows consist of URL,serverIP and many other ...
0
votes
1answer
249 views

Smart cards and the behaviour of the browser. Is the PIN cached?

When using smart cards for certificate-based authentication, is the PIN entered by the user to authenticate his smart card to the browser is cached? OR does the certificate gets cached by the browser? ...
1
vote
0answers
27 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
0
votes
1answer
135 views

Suspicious Redirect to malicious website

While using a 3rd party platform my company is working with (e.g. platform.com) the following issue appeared. I clicked on a button in order to locally download an excel sheet (report) that was ...
1
vote
0answers
40 views

How does cache partitioning prevent covert/side-channel attacks? [closed]

In a report on an open-source separation kernel (Muen kernel) I was reading, in the future work section, it says that cache coloring can be implemented to prevent covert/side-channel attacks. It is ...
5
votes
1answer
125 views

What can stop a browser to cache data from ProtonMail conversations?

I think this question arises primarily from my insufficient understanding of browser caching. Let's log in to ProtonMail, and read a message. My understanding is that an encrypted 'blob' of data gets ...
1
vote
0answers
49 views

Can cache attacks be executed on a single thread architecture?

Despite an extensive research on the subject, I'm wondering if there exists side channel attacks based on cache use which are conducted on single threaded architecture, smart cards for instance. I'm ...
2
votes
1answer
670 views

Caching personal data: GDPR

There are requests in my web application that contain "personal data" (name, postal code, phone number, date of birth etc). I would like to know what caching controls are advisable. I am using HTTPS. ...
1
vote
0answers
109 views

Recommended caching headers

I am testing web application where some requests returns private data, which shouldn't be save in cache. Response contains headers: Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache ...
1
vote
0answers
662 views

Side channel attack with flush+reload

I have been reading about cache side channel attacks and the "Flush+Reload" method came up a decent amount. Before putting forth my question, this is what I understand about the Flush+reload technique....
12
votes
1answer
360 views

Browser cache information disclosure

Observing the time needed by a browser to load external resources such as images potentially discloses information about whether those resources have been accessed before. Explanation: For example, ...
0
votes
1answer
289 views

Does a RAM Disk Actually Help When Password Cracking a Small Hash

I've been reading up on RAM Disks and their roles in various uses. The role one no one talks much about is password cracking. I pulled the below quote from here "It's also important to know that hard ...
1
vote
0answers
244 views

Is access token saved in Cache.db-wal bad for iOS app?

tested iOS application probably uses special Token directive for authentication to server. This token was found in file Cache.db-wal. I can't understand, why it's just in this one file and not in ...
5
votes
1answer
120 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
6
votes
1answer
351 views

e-tags on sensitive information

Suppose we have a big JSON document that only certain users can see, but that rarely changes, but which, if it does change, users expect to see the change quite quickly. It makes sense to use etags ...
0
votes
1answer
2k views

POST request no-cache header

During security tests/assessments it is often said that you need to set the cache-control to no-cache (and some other things). But as I was looking at this I found that POST requests are not cached (...
26
votes
7answers
8k views

Why do we need HTTPS for static content? If we can have a checksum at the end signed by the private key, won't that prove the validity?

This method which I am talking about can improve caching of images, videos, and CSS by the ISP rather than just depending on the browser cache. And it also proves the validity of the sender. Is there ...
3
votes
1answer
718 views

Can I use CloudFlare if I want to avoid NSA and FISA secret orders? [closed]

We're running a web service in Europe, secured with TLS and we're using private keys generated on our private hardware. We would like to use CloudFlare for DDoS protection and caching reverse proxy. ...
2
votes
1answer
277 views

FTP session opened from an unknown IP

I have a website made in Magento and hosted on an Ubuntu server and since a few months have been registering FTP connections open from unknown IP trying to open the file lic.php. In the proftpd.log ...
2
votes
1answer
557 views

In-Memory Database Storage and Security (MemSQL, Spark, Redis, Geode, et al)

There is a growing trend to utilize more In-Memory Storage for a wide variety of use cases from big data analytics (Spark) to faster processing power (MemSQL) to caching (Redis) most frequently ...
10
votes
3answers
1k views

HTTP Content-Security-Policy Nonce and Caching

Is anyone here able to clarify how caching affects adding a nonce=value to all inline javascript? If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. ...
6
votes
2answers
2k views

Is it safe to use Memcached in a shared hosting environment?

The shared hosting I am using had Memcached enabled, I searched some forums that using Memcached in a shared hosting environment, can cause security problems like view the cache of the other user, ...
3
votes
2answers
111 views

Is CacheBleed fixed in LibreSSL?

https://ts.data61.csiro.au/projects/TS/cachebleed/ Only thing I can find: http://undeadly.org/cgi?action=article&sid=20160301141941 Q: was CacheBleed fixed in LibreSSL?
4
votes
1answer
1k views

Is browser memory cache considered as security issue?

Came across an application that uses below header to prevent caching. cache-control: no-store, no-cache, must-revalidate, proxy-revalidate Expires: 0 Pragma: no-cache As per standards, with this ...
19
votes
2answers
2k views

Principles of cache attacks

There are many scientific publications that deal with cache attacks. Most recently, the CacheBleed attack was published which exploits cache bank conflicts on the Intel Sandy Bridge architecture. Most ...
4
votes
1answer
3k views

How to detect mimikatz usage on LAN

My boss is has made it clear that we need better ways of detecting mimikatz usage on the network- and I would agree. In place already for detection is suricata/ET PRO rule set on a couple of taps. ...
1
vote
0answers
388 views

Should I blur the cached snapshot of my app?

I recently ran a security scan on one of my iOS apps that suggested I modify my apps display as it enters the background so that the screenshot stored in the cache does not expose any sensitive data. ...
3
votes
1answer
679 views

Powershell and cached credentials

In my environment we have powershell remoting off- I get around this using 2 hop scripts, packages(exe -no creds are stored in code- local privs only), and iwmi. I never pass creds to the endpoint, ...
2
votes
1answer
117 views

Is DNS caching a security vulnerability?

In FireFox, for example, there are network.dnsCacheExpiration and network.dnsCacheEntries preferences in about:config. Is increasing the length of time and number of cached DNS entries a security ...
5
votes
2answers
792 views

Why use MD4 for caching?

ccache is a popular tool for speeding recompilation with GCC and other compilers. It works by caching previous compilations and detecting when the same compilation is done again. The detection is ...
7
votes
2answers
2k views

Are webcache pages more secure?

Whenever I see a suspicious looking URL I want to go to, I usually just search it up on Google's webcache and browse the site that way. But I just realized that I never really had evidence to support ...
3
votes
1answer
354 views

HTTP Response splitting - is it browser caching or server caching issue?

I am trying to wrap my head around HTTP Response splitting. Although using WebGoat etc. I was able to learn how to do it in practice, but I guess I am still confused with some very fundamental ...
1
vote
0answers
62 views

Is there a “smart cache” device which provides cache if authorized?

Is there an implementation of a HTTP (or decoded HTTPS) optimization device which would allow for "smart caching" - i.e. the ability to release some cached content (initially transferred by someone ...
0
votes
1answer
51 views

CDN information [closed]

If I have a website that is content based, and the web server accesses a CMS to determine what to display on the site for a particular page. This is not particularly fast and it requires computing ...
-3
votes
1answer
69 views

What threats involve in cache miss

What are the possible consequences of a cache miss? In other word, is it possible that a cache miss could cause a security threat? Thank you.
11
votes
1answer
39k views

Why does IE11 refuse to enable back navigation caching for HTTPS?

On my website, I get this error message in the console: DOM7011: The code on this page disabled back and forward caching. For more information, see: http://go.microsoft.com/fwlink/?LinkID=291337 ...
2
votes
0answers
337 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
11
votes
1answer
7k views

HTTP Caching Headers: private vs no-cache

We're currently reviewing our set of "no-cache" security headers: Cache-Control "no-cache, no-store, must-revalidate Pragma "no-cache" Expires 0 Besides the "standard" set above, I found this ...
3
votes
1answer
160 views

What kind of attacks can target static resources?

Static resources and their caching interests me from the security perspective. Let's say we have an .jpg file requisted from the origin -> going through a reverse proxy with caching -> reaching the ...
2
votes
3answers
1k views

What is risk of having memcache in public interface?

To what extent a hacker can potentially cause harm to a server? Can you please give few examples? Recently, there was a data breach in my website and I found out this interface was public-facing and ...
14
votes
1answer
2k views

Is there any evidence misusing the HTTP Pragma header in responses has any (unique) effect?

I've been investigating the Pragma header, since there are already two other cache-busting HTTP response headers (Cache-Control & Expires), and I was interested in which browsers use(d) the old ...
2
votes
0answers
591 views

How to get directly to text versions of Google cached pages [closed]

http://navigators.com/cached.html According to the bottom of that site, it seems the easiest way to view websites without giving them your IP is: "Edit the heck out" of google URLs like this: ...
3
votes
1answer
982 views

Does visiting cached pages disclose my IP address to site admin? [closed]

I know it discloses my IP to Google, but is my IP also disclosed to the owner of the site of which Google made cached pages that I'm looking at? And how about anything I do within the cached page - ...
3
votes
1answer
112 views

Understanding how openx cache was infected

I have a system that uses openx for serving banners. I have recently noticed that several cache file in /var/cache contain infected code. The code contains sql queries that create several php files in ...
1
vote
1answer
264 views

What's the typical approach to caching invalid authentication attempts?

Clients (actually software pieces developed by some random dudes all over the Internet) are authenticating on a web server using "basic" authentication scheme and to do so they are passing the ...
1
vote
1answer
299 views

Is this a security breach?

I read in an article that if the request is authenticated or secure (i.e., HTTPS), it won’t be cached. But in https, burp has reported an issue stating http response is as follows: Cache-Control: ...
4
votes
3answers
3k views

Should login pages be cacheable?

I'm considering the relative benefits/disadvantages of making a login page cacheable. Note that here I'm referring to the page containing the form into which the user enters their username and ...
2
votes
1answer
1k views

Caching Behaviour on major browsers

Before I even ask the question - this is a hard question to frame, so I welcome edits to improve clarity. How do major browsers decide how to cache responses, especially if said responses are ...
1
vote
2answers
148 views

PHP Handlers and Caching

I recently began configuring our production server for a new Drupal site. Up till now, I've always used the default PHP handler mod_php, and removed write privileges for any directory/file except ...
3
votes
1answer
171 views

Optimise user data fetch using S3

I'm writing a mobile app that communicates with my server using REST. Upon every launch, the app makes a call to the server api to check whether there was a change in the user details (using a ...