ASVS 5.0 V14.3.2 is a Level 2 requirement. The application must send sufficient anti caching headers, such as Cache-Control: no-store, so that sensitive data is not stored in browser caches.
Why it matters
Browsers keep copies of pages for speed and for the Back button. On a shared device, a stored statement or medical record can be read after the user leaves. Disk caches can also be read by other software on the machine.
How to implement it
Send the header on every response that contains private data:
Cache-Control: no-store
Pragma: no-cache
Apply it in one place so it covers new routes by default:
app.use((req, res, next) => {
if (req.session && req.session.userId) {
res.set("Cache-Control", "no-store");
}
next();
});
@app.after_request
def no_store(resp):
if "user_id" in session:
resp.headers["Cache-Control"] = "no-store"
return resp
Static public assets can stay cacheable. Keep the rule based on whether the response is personalized, not on the URL.
How to test it
curl -sI -H "Cookie: session=VALID" https://example.com/account | grep -i cache-control
Expect no-store. Check API responses and file downloads as well, not only HTML pages.
Common mistakes
- Using
no-cacheand believing it prevents storage. It permits storing with revalidation. - Setting headers on the page but not on the JSON endpoints behind it.
- Letting a proxy add its own caching headers.
Quick check
Which is stronger, no-cache or no-store?
no-store. It forbids saving the response at all.
