Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've seen a number of online banking sites which, after logging out, have a message recommending that I clear my browser cache to ensure my private banking information remains secure.

Is that really needed in this day and age? Isn't sending a 'no-cache' HTTP header and putting everything over HTTPS sufficient to prevent someone from viewing the the contents of pages which i visited?

share|improve this question

migrated from serverfault.com Jul 10 '11 at 20:31

This question came from our site for system and network administrators.

2 Answers 2

up vote 12 down vote accepted

They're just being careful. If the server sets the correct headers to make sure nothing is cached client-side it should be fine. Since the bank can't control if the browser acts like it's supposed to they ask you to make sure.

Note that the Cache-Control: no-cache header is not intended for what you think it is. It is designed to tell the browser to revalidate with the server before using its cached version. This implicitly allows the browser to cache the request. However, probably due to widespread incorrect use of this directive, most browsers have started using no-cache to mean 'don't cache this content'.

The correct header the server needs to send to avoid caching is Cache Control: No-store.

share|improve this answer
    
Ha! Beat you by 20 seconds. +1 for accurate and more detailed information however. –  Chris S Jul 10 '11 at 16:38

Almost every major browser does not cache secured pages automatically. If you're using an ancient browser (or a really obscure one) this may be a concern. Additionally most browsers respect the Cache-Control header, which allows a server to specify caching policy to a browser.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.