Unit 3: Headers · Lesson 3 of 5 · 18 min

Keeping private pages out of caches

Cache-Control decides whether a proxy may keep a copy of someone's personal page.

mission

You are
The analyst reviewing the shop.
Situation
A customer at a shared office reports seeing another person's order receipt. The office runs a caching proxy.
Goal
Check which personal pages tell caches to keep a copy.
Hand in
The page that allows caching, and the header it should send.

A shared cache locker

01

Sign in and save the session

learner@web-lab
curl -s -o /dev/null -w '%{http_code}\n' -c jar.txt -d @shop-account.txt http://127.0.0.1:8000/login
303

you should see 303: signed in, cookie saved to jar.txt.

02

Check the account page

learner@web-lab
curl -sI -b jar.txt http://127.0.0.1:8000/account | grep -i cache-control
Cache-Control: no-store

you should see no-store: nothing may keep a copy.

03

Check the receipt page

learner@web-lab
curl -s -b jar.txt http://127.0.0.1:8000/receipt | grep Order
<p>Order 1042 for learner, total 30.5, ship to 12 Lab Road, Leeds.</p>
curl -sI -b jar.txt http://127.0.0.1:8000/receipt | grep -i cache-control
Cache-Control: public, max-age=86400

you should see A name and address, marked public for a whole day. Any shared cache on the way may store it and serve it to the next person.

defender tip public overrides the usual rule that responses to signed-in requests are not shared. On personal data it is almost always a mistake.

04

Compare with a static file

learner@web-lab
curl -sI http://127.0.0.1:8000/static/site.css | grep -i cache-control
Cache-Control: max-age=3600

you should see max-age=3600 is right for a stylesheet that is the same for everyone. The receipt is not.

Cache-Control on personal pages

/receipt today
Cache-Control: public, max-age=86400

Any cache may keep it for a day.

Fix
Cache-Control: no-store

Nobody keeps a copy, not even the browser's disk cache.

What a defender takes away

  1. 1Personal pages should send Cache-Control: no-store.
  2. 2public on a signed-in page can leak it to the next user of a shared cache.
  3. 3Test caching headers while signed in; anonymous requests may get a redirect instead.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.