
Secure pages can be cached in browser
Reported by Dimitris Apostolou | February 9th, 2014 @ 11:27 PM
Reproducibility: always
Steps:
GET: https://gpgtools.org/
GET: https://gpgtools.org/css/font.14.css
GET: https://gpgtools.org/css/main.1386177977.css
GET: https://gpgtools.org/css/normalize.css
GET: https://gpgtools.org/donate.html
GET: https://gpgtools.org/gpgsuite.html
GET: https://gpgtools.org/js/jquery.scrollTo.min.js
GET: https://gpgtools.org/js/main.14.js
GET: https://gpgtools.org/js/plugins.js
GET: https://gpgtools.org/js/vendor/jquery-1.9.1.min.js
GET: https://gpgtools.org/js/vendor/modernizr-2.6.2.min.js
GET: https://gpgtools.org/news.html
GET: https://gpgtools.org/opensource.html
GET: https://gpgtools.org/piwik/piwik.php?idsite=1&rec=1
What happened:
Secure pages can be cached in browser. Cache control is not set in
HTTP header nor HTML header. Sensitive content can be recovered
from browser storage.
Expected result:
Secure pages cannot be cached in browser.
Solution:
Set HTTP header with: 'Pragma: No-cache' and 'Cache-control:
No-cache'.
Alternatively, this can be set in the HTML header by:
but some browsers may have problem using this method.
Comments and changes to this ticket
-
Dimitris Apostolou February 9th, 2014 @ 11:31 PM
Alternatively, this can be set in the HTML header by:
<META HTTP-EQUIV='Pragma' CONTENT='no-cache'> <META HTTP-EQUIV='Cache-Control' CONTENT='no-cache'>
but some browsers may have problem using this method.
-
steve February 10th, 2014 @ 12:03 AM
- State changed from new to wontfix
- Importance changed from to Low
Hi Dimitirs,
caching in this case is wanted behavior to improve browser speed. Deactivating caching would not help a lot since an entry would remain in the browser history.
Please Sign in or create a free account to add a new ticket.
With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป
Organize issues related to http://gpgtools.org