Cache-Control Security Check

A response carrying session data left in a cache is a classic leak: a statement sits in the browser cache of a shared computer, or worse, an intermediate proxy serves one user's page to another. The Cache-Control header is what prevents that, and the difference between directives that look equivalent is exactly where most people get it wrong.

Enter the header and tick whether the response carries a cookie or requires authentication, and the page points out what is loose. The distinction that matters most is between the directive forbidding storage and the one demanding revalidation: the first prevents storing at all; the second allows storing and merely requires checking before reuse — and checking against a server that is down, or with an already-expired session, can hand back the stored copy.

For authenticated content, the usual combination forbids storage and marks the response private, which blocks shared caches. Remember that browsers treat the back button specially: without the explicit prohibition, the page can reappear from memory even after logout. And that omitting the header does not mean no caching — it means letting the browser decide by heuristic, which tends to be generous.