Title
Missing HTTP Cache-Control Headers on Authentication Page May Lead to Improper Caching
Summary
The login page does not return explicit HTTP cache-control headers such as Cache-Control, Pragma, or Expires. Without these directives, browsers and intermediary caches may rely on default caching behavior, which can lead to inconsistent handling of authentication-related content.
Although the tested page is publicly accessible, security best practices recommend explicitly disabling caching for authentication pages to reduce the risk of sensitive information being stored or reused.
Technical Description
Testing of the login endpoint showed:
No Cache-Control header
No ETag
No Last-Modified
No explicit cache policy
Tool output:
Cacheable:
YES, but freshness duration is very short
No Cache-Control header received
No headers available to determine cache duration.
ETag header missing
Last-Modified header missing
Without explicit cache directives, browser or intermediary cache behavior depends on implementation and may not align with the intended security policy.
Steps to Reproduce
Visit:
https:
Analyze the response using:
Burp Suite
Browser Developer Tools
Request Metrics HTTP Cache Checker
Observe the absence of:
Cache-Control
Pragma
Expires
ETag
Last-Modified
Working Proof of Concept
GET /login HTTP/2
HTTP/2 200 OK
Date: Thu, 23 Jul 2026 10:40:03 GMT
Missing:
Cache-Control
Pragma
Expires
ETag
Last-Modified
Request Metrics Result:
Cacheable:
YES
Cache-Control:
Not Present
ETag:
Missing
Last-Modified:
Missing
Attack Scenario
A user accesses the login page from a shared or unmanaged device.
The browser or an intermediary cache stores the response according to its default behavior.
Authentication-related content may persist longer than intended.
On systems where sensitive responses are also improperly cached, this could contribute to information disclosure.
User Impact
Authentication pages may not receive intended cache protection.
Increased risk on shared or public devices.
Potential privacy concerns if other sensitive responses are similarly affected.
Business Impact
Reduced adherence to secure HTTP caching best practices.
Increased risk if authenticated pages share the same cache policy.
Possible compliance findings during security assessments.
Remediation
For authentication pages, return headers similar to:
Cache-Control: no-store, no-cache, must-revalidate, private
Pragma: no-cache
Expires: 0
Additionally:
Apply these headers to all login, logout, password reset, MFA, and account management endpoints.
Verify that authenticated pages containing sensitive information are never cached.
Periodically review caching behavior during security assessments.image.png