cache-control and pragma

[Steve James]

Hi, we've just had some PEN testing and an issue that was raised was that "Applications should return caching directives instructing browsers not to store local copies of any sensitive data"

The 3 pages the PEN testers highlighted were

• ufsmain - we've checked and they are present so we are checking with the PEN testers.
  
  uploader - this pages uses "cache-control private". I'm looking at what the difference is.
  
  ufsajax - no cache control nor pragma headers. We can of course turn ajax off for specific forms (not that we want to).

Can you advise whether this will be fixed in a future release or the reason why this is by design?

Thanks

[Steve James]

Hi Happy New Year Ebase, have you spotted this query?

Thanks

[Jon]

And a Happy New Year to you too. No, we managed to miss this..

ufsmain: this is the main servlet and should be OK. We explicitly set directives to prevent caching

uploader: I'll raise a bug report to get this investigated. But I think we are talking about the static page presented by the uploader. So not much of a security risk

ufsajax: all requests are POSTs, so my understanding is they won't be cached by browsers.

[Steve James]

Thanks Jon