OWASPASVS 5.0 requirement
ASVS-V14.2.5 Caching mechanisms are configured to only cache responses which have the expected content type for that resource and do not contain…
- Standard
- OWASP ASVS 5.0
- Chapter
- V14 Data Protection
- Section
- V14.2 General Data Protection
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that caching mechanisms are configured to only cache responses which have the expected content type for that resource and do not contain sensitive, dynamic content. The web server should return a 404 or 302 response when a non-existent file is accessed rather than returning a different, valid file. This should prevent Web Cache Deception attacks.