Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've seen a number of online banking sites which, after logging out, have a message recommending that I clear my browser cache to ensure my private banking information remains secure.

Is that really needed in this day and age? Isn't sending a 'no-cache' HTTP header and putting everything over HTTPS sufficient to prevent someone from viewing the the contents of pages which i visited?

share|improve this question

migrated from Jul 10 '11 at 20:31

This question came from our site for system and network administrators.

up vote 12 down vote accepted

They're just being careful. If the server sets the correct headers to make sure nothing is cached client-side it should be fine. Since the bank can't control if the browser acts like it's supposed to they ask you to make sure.

Note that the Cache-Control: no-cache header is not intended for what you think it is. It is designed to tell the browser to revalidate with the server before using its cached version. This implicitly allows the browser to cache the request. However, probably due to widespread incorrect use of this directive, most browsers have started using no-cache to mean 'don't cache this content'.

The correct header the server needs to send to avoid caching is Cache Control: No-store.

share|improve this answer
Ha! Beat you by 20 seconds. +1 for accurate and more detailed information however. – Chris S Jul 10 '11 at 16:38

Almost every major browser does not cache secured pages automatically. If you're using an ancient browser (or a really obscure one) this may be a concern. Additionally most browsers respect the Cache-Control header, which allows a server to specify caching policy to a browser.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .