7

I've seen a number of online banking sites which, after logging out, have a message recommending that I clear my browser cache to ensure my private banking information remains secure.

Is that really needed in this day and age? Isn't sending a 'no-cache' HTTP header and putting everything over HTTPS sufficient to prevent someone from viewing the the contents of pages which i visited?

2 Answers 2

13

They're just being careful. If the server sets the correct headers to make sure nothing is cached client-side it should be fine. Since the bank can't control if the browser acts like it's supposed to they ask you to make sure.

Note that the Cache-Control: no-cache header is not intended for what you think it is. It is designed to tell the browser to revalidate with the server before using its cached version. This implicitly allows the browser to cache the request. However, probably due to widespread incorrect use of this directive, most browsers have started using no-cache to mean 'don't cache this content'.

The correct header the server needs to send to avoid caching is Cache Control: No-store.

1
  • Ha! Beat you by 20 seconds. +1 for accurate and more detailed information however.
    – Chris S
    Jul 10, 2011 at 16:38
4

Almost every major browser does not cache secured pages automatically. If you're using an ancient browser (or a really obscure one) this may be a concern. Additionally most browsers respect the Cache-Control header, which allows a server to specify caching policy to a browser.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .