Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Cacheable responses

Andrew | Last updated: Dec 13, 2016 10:54PM UTC

HTTP, not just HTTPS responses obey the cache control headers, yes? So, shouldn't the finding for 'https://portswigger.net/KnowledgeBase/issues/Details/00700100_CacheableHTTPSresponse' be more generic. I noted in a recent test the burp does NOT catch these cache issues when HTTP is the protocol in use. I guess I'll research the standards more, but thought to ask for your expert input as well. I spent some time reading the standards and I saw no reason why http shouldn't be in the mix and have HTTPS removed and just have it generically be 'Cacheable Response' instead of 'Cacheable HTTPS...' Thanks.

PortSwigger Agent | Last updated: Dec 14, 2016 09:12AM UTC

The original thinking here was that back in the day, HTTP was often used for non-sensitive public content while HTTPS was used for sensitive content. Obviously, if HTTP is used for sensitive content then there are bigger problems than client-side caching. These days, with the move to HTTPS everywhere, this distinction is disappearing so at some point we might modify the logic/description of this issue.

Burp User | Last updated: Dec 14, 2016 04:14PM UTC

Right, but it seemed like a bug in Burp not to flag it.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.