Description

This detector identifies when sensitive cookies are set without proper cache control directives. When sensitive cookies lack cache control protection, they may be stored in browser caches or intermediate proxies, potentially exposing sensitive session data to unauthorized access.

Detection Strategy

• A vulnerability is reported when the HTTP response contains Set-Cookie headers for sensitive cookies (like session cookies, authentication tokens) AND the response lacks proper Cache-Control directives

• The detector considers Cache-Control directives safe when they include values like 'no-cache', 'no-store', or 'private' that prevent caching of sensitive data

• Each sensitive cookie without adequate cache protection generates a separate vulnerability report identifying the specific cookie name and its raw header content