Security finding
A page that sets a cookie may be stored in a shared cache
Security Error Severity: High
Part of the audit Security headers. Finding id: security.cacheableResponseSetsCookie.
What it costs you
A CDN or proxy can keep the response, cookie included, and give it to the next visitor. One visitor's session or personal page can then be shown to someone else.
What to do
Send Cache-Control: private or no-store on every response that sets a cookie or depends on one. Set cookies only on pages that need them, so the rest can be cached.
What it checks
- Cached page sets a cookie
How to fix it
Mark responses with cookies as private in nginx
How to check: curl -sI [page url] shows Cache-Control: private or no-store next to Set-Cookie.
Stop shared caching of pages with cookies
- Find where Cache-Control is set for [page url]: the application, the CMS's cache plugin or the CDN's rules.
- Send private or no-store on every response with Set-Cookie, and check that the CDN does not cache responses with cookies.
- If a page is personalised by a cookie and should be cached, send Vary: Cookie.
How to check: curl -sI [page url]: a response with Set-Cookie carries Cache-Control private or no-store.