Content Cacheability
Reference
Remediation
- Set cache-control headers: Use appropriate cache-control headers (no-cache, no-store, private) for sensitive content.
- Review cacheable content: Audit all responses to ensure sensitive data is not cacheable by proxies or CDNs.
- Use private caching: Set Cache-Control: private for user-specific content to prevent shared caching.
- Implement proper expiration: Set appropriate cache expiration times based on content sensitivity.
- Test caching behavior: Verify that sensitive content is not cached by testing with proxy servers.
About
Content cacheability issues occur when web applications allow sensitive, personal, or user-specific information to be cached by intermediate servers, proxies, or CDNs. This can lead to information disclosure when cached sensitive content is served to unauthorized users.
Risks
Medium Inappropriate content caching can expose sensitive user data, personal information, or confidential content to unauthorized users through shared cache systems, potentially violating privacy and security requirements.