Do i really need to clear my browser cache after using a https site to protect the privacy of the pages i visited?
I've seen a number of online banking sites which, after logging out, have a message recommending that I clear my browser cache to ensure my private banking information remains secure.
Is that really needed in this day and age? Isn't sending a 'no-cache' HTTP header and putting everything over HTTPS sufficient to prevent someone from viewing the the contents of pages which i visited?
They're just being careful. If the server sets the correct headers to make sure nothing is cached client-side it should be fine. Since the bank can't control if the browser acts like it's supposed to they ask you to make sure.
Note that the Cache-Control: no-cache
header is not intended for what you think it is. It is designed to tell the browser to revalidate with the server before using its cached version. This implicitly allows the browser to cache the request. However, probably due to widespread incorrect use of this directive, most browsers have started using no-cache to mean 'don't cache this content'.
The correct header the server needs to send to avoid caching is Cache Control: No-store
.
Almost every major browser does not cache secured pages automatically. If you're using an ancient browser (or a really obscure one) this may be a concern. Additionally most browsers respect the Cache-Control header, which allows a server to specify caching policy to a browser.