articles Prevent information leaking in Rails
By default Rails sets the
Cache-Control HTTP Header to
max-age=0, private, must-revalidate, which means the browser needs to revalidate the page on each request, BUT the browser still stores the cached version of the page.
The problem with this, if a user clicks the back button of the browser, it won't revalidate the page, it will just simply load the page from it's cache. This can lead to serious information leaking, if you a user logs out from an application and someone else sits to that computer and navigates back in history. A more advanced attacker can even decrypt the browser's cache files and access sensitive information.
To address this issue, you can explicitly set the
Cache-Control header in your app with a before filter:
You can call this filter in each controller where you display sensitive information(usually every controller behind authentication). Alternatively, you can ask you users at sign in, whether they are on a public or private computer and set the cache header based on their choice.
Did you enjoy reading this? Follow me on Twitter or sign up to my newsletter for more content like this!
I run an indie startup providing vulnerability scanning for your Ruby on Rails app.It is free to use at the moment, and I am grateful for any feedback about it.
If you would like to give it a spin, you can do it here: Vulnerability Scanning for your Ruby on Rails app!