Jim's Blog Ramblings about novels, comics, programming, and other geek topics

Securing ASP.NET Web Sites: Form Caching

What is "Form Caching Vulnerability"?

The Form Caching Vulnerability allows sensitive form fields to be cached and retrieved by another user on the same client.

CWE-525: Information Exposure Through Browser Caching

Securing ASP.NET Forms

If your web site users are submitting sensitive data via forms, then you should not cache the form fields. If a user is using a shared computer (such as at an Internet cafe), then the next user could see the form field values by accessing the same page on the same client.

To fix this for ASP.NET web sites, you can add the following meta tags to your MasterPage or each ASP.NET web page.

<meta http-equiv="Pragma" content="no-cache" />
<meta http-equiv="Cache-Control" content="no-store,no-cache" />

If you would rather only prevent caching on form submission pages, then you can add the following code to the page's OnLoad event. Alternatively, you could just add the meta tags to the specific form pages.

Response.CacheControl = "no-store,no-cache";
Response.AddHeader("Pragma", "no-cache");
Response.Expires = -1;

Also note that when using Microsoft Internet Explorer version 6 or earlier, there is a bug that allows users to access form field values from the Temporary Internet Files directory. See MS KB Article# 222064

Reference

• "Pragma: No-cache" Tag May Not Prevent Page from Being Cached (Microsoft Support)
• CWE-525: Information Exposure Through Browser Caching