Cache-Control & Data Privacy Scanner

Audit HTTP Cache-Control headers to ensure sensitive customer pages are never cached by shared proxies.

Technical Scope & Verification Behavior

Validates Cache-Control: no-store, private on authenticated APIs and dynamic dashboards to prevent CDN cache leaks of personal data.

Automated Inspection Checks (6)

Passive URL parameter fuzzing

Non-destructive boundary tests

Header & cookie flag assertions

Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

GET /api/user/billing Cache-Control: public, max-age=3600

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)

Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

No-Store on User Endpoints

patch.diff (typescript)

--- a/handler.typescript (Vulnerable)

res.setHeader('Cache-Control', 'public, max-age=300');

+++ b/handler.typescript (Remediated)

res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, private');

Ensure authenticated routes use private, no-store headers to prevent intermediate CDN caching.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Add Cache-Control: no-store, private to the response headers of this authenticated route."

Run Isolated Check

Test your public domain specifically for Cache-Control & Data Privacy Scanner.

100% passive • No server load

Specification Details

CVSS Score: 5.8 / 10.0
Severity Level: MEDIUM
Category: CONFIGURATION
Test Vectors: 6 automated
Execution SLA: < 2.5 seconds
False Positive Defense: Strict assertion

Related Standards

#Caching#CDN#Privacy

Frequently Audited Together

Checks commonly evaluated alongside Cache-Control & Data Privacy Scanner during surface discovery.

View all 41 checks →

VULNERABILITY

CSRF Protection Scanner

Verify anti-CSRF tokens, SameSite cookie policies, and origin validation on sensitive state-changing routes.

CVSS 6.5

VULNERABILITY

Client-Side Browser Storage Leak Scanner

Detect sensitive tokens, passwords, or PII stored in unencrypted localStorage or sessionStorage.

CVSS 6.2

VULNERABILITY

Host Header & Cache Poisoning Scanner

Detect web cache poisoning, password reset link poisoning, and server-side routing hijack via spoofed Host headers.

CVSS 6.8

Run continuous monitoring for Cache-Control & Data Privacy Scanner

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog