Ensure safe, static resources are cached with freshness limits and per-user data is never shared-cached

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Inspect the caching response headers for a sample of static and dynamic resources. Run the following command against a static resource. It reports a single verdict and rejects a resource that carries a non-shareable directive alongside caching: URL="https://<SERVER_URL>/static/<PATH>" resp=$(curl -sS -m 10 -D - -o /dev/null "$URL" 2>/dev/null) || resp="" code=$(printf '%s\n' "$resp" | awk 'NR==1{print $2}') val=$(printf '%s\n' "$resp" | grep -Ei '^(etag|last-modified):' | tr -d '\r') cc=$(printf '%s\n' "$resp" | grep -Ei '^cache-control:' | head -1 | sed 's/^[Cc]ache- [Cc]ontrol:[[:space:]]*//' | tr -d '\r') tokens=$(printf '%s' "$cc" | tr ',' '\n' | sed 's/^[[:space:]]*//; s/[[:space:]]*$//' | tr 'A-Z' 'a-z') has_maxage=$(printf '%s\n' "$tokens" | grep -Eqx 'max-age=[0-9]+' && echo 1) has_nostore=$(printf '%s\n' "$tokens" | grep -Eqx 'no-store' && echo 1) has_private=$(printf '%s\n' "$tokens" | grep -Eqx 'private' && echo 1) if ! printf '%s' "$code" | grep -Eq '^[0-9]+$'; then echo "ERROR: static resource unreachable, no attribution possible" elif [ "$code" -ge 400 ]; then echo "ERROR: static path returned $code, cannot attribute cache policy to the resource" elif [ -n "$has_no...

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Enable ETag or Last-Modified generation for genuinely static content, and set Cache-Control max-age values appropriate to how static each resource is, with invalidation on update. Mark all dynamic, identity-sensitive, and authorization-related responses Cache-Control: no-store. This is web-server and application configuration. Where a reverse proxy serves static content, the following nginx fragment is illustrative. It sets a validator and max-age on the static location and no-store on the dynamic location: location /static/ { etag on; add_header Cache-Control "public, max-age=3600"; } location /api/ { add_header Cache-Control "no-store" always; } At the protocol layer, set cacheScope: private on resources/list, resources/read, and other cacheable results for any per-user or identity-sensitive data. Reserve cacheScope: public for genuinely non-identity-specific data. Set ttlMs to a freshness bound appropriate to the data. Enforce per-primitive access control independently of the cache scope.