#125 ✓wontfix
Dimitris Apostolou

Secure pages can be cached in browser

Reported by Dimitris Apostolou | February 9th, 2014 @ 11:27 PM

Reproducibility: always

Steps:
GET: https://gpgtools.org/
GET: https://gpgtools.org/css/font.14.css
GET: https://gpgtools.org/css/main.1386177977.css
GET: https://gpgtools.org/css/normalize.css
GET: https://gpgtools.org/donate.html
GET: https://gpgtools.org/gpgsuite.html
GET: https://gpgtools.org/js/jquery.scrollTo.min.js
GET: https://gpgtools.org/js/main.14.js
GET: https://gpgtools.org/js/plugins.js
GET: https://gpgtools.org/js/vendor/jquery-1.9.1.min.js
GET: https://gpgtools.org/js/vendor/modernizr-2.6.2.min.js
GET: https://gpgtools.org/news.html
GET: https://gpgtools.org/opensource.html
GET: https://gpgtools.org/piwik/piwik.php?idsite=1&rec=1

What happened:
Secure pages can be cached in browser. Cache control is not set in HTTP header nor HTML header. Sensitive content can be recovered from browser storage.

Expected result:
Secure pages cannot be cached in browser.

Solution:
Set HTTP header with: 'Pragma: No-cache' and 'Cache-control: No-cache'.
Alternatively, this can be set in the HTML header by:


but some browsers may have problem using this method.

Comments and changes to this ticket

  • Dimitris Apostolou

    Dimitris Apostolou February 9th, 2014 @ 11:31 PM

    Alternatively, this can be set in the HTML header by:

    <META HTTP-EQUIV='Pragma' CONTENT='no-cache'> 
<META HTTP-EQUIV='Cache-Control' CONTENT='no-cache'>

    but some browsers may have problem using this method.

  • steve

    steve February 10th, 2014 @ 12:03 AM

    • State changed from “new” to “wontfix”
    • Importance changed from “” to “Low”

    Hi Dimitirs,

    caching in this case is wanted behavior to improve browser speed. Deactivating caching would not help a lot since an entry would remain in the browser history.

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.

New-ticket Create new ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป

Organize issues related to http://gpgtools.org

Shared Ticket Bins

People watching this ticket

Pages