Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Cacheable responses

Andrew | Last updated: Dec 13, 2016 10:54PM UTC

HTTP, not just HTTPS responses obey the cache control headers, yes? So, shouldn't the finding for 'https://portswigger.net/KnowledgeBase/issues/Details/00700100_CacheableHTTPSresponse' be more generic. I noted in a recent test the burp does NOT catch these cache issues when HTTP is the protocol in use. I guess I'll research the standards more, but thought to ask for your expert input as well. I spent some time reading the standards and I saw no reason why http shouldn't be in the mix and have HTTPS removed and just have it generically be 'Cacheable Response' instead of 'Cacheable HTTPS...' Thanks.

PortSwigger Agent | Last updated: Dec 14, 2016 09:12AM UTC

The original thinking here was that back in the day, HTTP was often used for non-sensitive public content while HTTPS was used for sensitive content. Obviously, if HTTP is used for sensitive content then there are bigger problems than client-side caching. These days, with the move to HTTPS everywhere, this distinction is disappearing so at some point we might modify the logic/description of this issue.

Burp User | Last updated: Dec 14, 2016 04:14PM UTC