Use of Web Browser Cache Containing Sensitive Information
Incomplete Variant
Structure: Simple
Description
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
Common Consequences 1
Scope: Confidentiality
Impact: Read Application Data
Browsers often store information in a client-side cache, which can leave behind sensitive information for other users to find and exploit, such as passwords or credit card numbers. The locations at most risk include public terminals, such as those in libraries and Internet cafes.
Potential Mitigations 4
Phase: Architecture and Design
Protect information stored in cache.
Phase: Architecture and DesignImplementation
Use a restrictive caching policy for forms and web pages that potentially contain sensitive information.
Phase: Architecture and Design
Do not store unnecessarily sensitive information in the cache.
Phase: Architecture and Design
Consider using encryption in the cache.
Modes of Introduction
Implementation
Related Attack Patterns
Related Weaknesses
Taxonomy Mapping
- OWASP Top Ten 2004
- OWASP Top Ten 2004