Cacheable HTTPS response
Summary: PortSwigger Research notes that browsers, including Internet Explorer, may store local cached copies of content received over HTTPS, and that sensitive data held in that cache can later be retrieved by other users with access to the same computer. The guidance is for applications to return caching directives telling browsers not to store sensitive data, either by configuring the web server to prevent caching for relevant paths or by setting the directives from within individual scripts.
Bottom line: The exposure here is a shared machine, not a network intrusion: anyone who later uses the same computer can pull sensitive responses straight out of the browser cache, which means your HTTPS encryption does nothing for data left behind on the endpoint.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026