Incomplete or No Cache-control and Pragma HTTP Header Set
Low
G
Gratipay
Submitted None
Actions:
Reported by
lulliii
Vulnerability Details
Technical details and impact analysis
Hello,
The cache-control and pragma HTTP header have not been set properly or are missing allowing the browser and proxies to cache content.
HTTP/1.1 200 OK
Connection: keep-alive
Server: gunicorn
Date: Sun, 27 Nov 2016 16:18:06 GMT
Content-Type: text/html; charset=UTF-8
X-Gratipay-Version: 2014
Set-Cookie: csrf_token=chYzzQF9UYGunrz4V68ggeuvV6MpTjTZ; expires=Sun, 04 Dec 2016 16:18:06 GMT; Path=/; secure
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Cache-Control: no-cache
Via: 1.1 vegur
Solution:
Whenever possible ensure the cache-control HTTP header is set with no-cache, no-store, must-revalidate, private; and that the pragma HTTP header is set with no-cache.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved