OWASPASVS 5.0 requirement

ASVS-V14.3.2 The application sets sufficient anti-caching http response header fields (i.e., cache-control: no-store) so that sensitive data is not…

L2 Published 2025 Official page ↗

Standard: OWASP ASVS 5.0
Chapter: V14 Data Protection
Section: V14.3 Client-side Data Protection
Level: L2 (requirement applies from this verification level up)

Requirement

Verify that the application sets sufficient anti-caching HTTP response header fields (i.e., Cache-Control: no-store) so that sensitive data is not cached in browsers.