Cache-Control on pages that set cookies

This check only applies when the response to / includes at least one Set-Cookie header, which marks it as session-bound or personalised; a response with no cookies passes automatically. Scan.now then reads Cache-Control. The check passes when the header contains no-store, or private (optionally with no-cache). It reports an informational finding when Cache-Control is absent, when it contains public, or when it sets a positive max-age or s-maxage without private, and also when a far-future Expires header stands in for a missing Cache-Control. The combination Set-Cookie plus public is called out specifically because it invites a shared cache to store the cookie itself. Cookie attributes are examined separately in the cookie checks.

HTTP caching (RFC 9111) lets shared caches such as CDNs, corporate proxies and reverse-proxy layers store a response and serve it to anyone who asks for the same URL. A response that varies per user must say so, or the cache has no way to know. The failure modes are concrete: a CDN configured to cache HTML stores the "Welcome back, Alice" page and shows it to Bob, complete with Alice's order history; a proxy caches the Set-Cookie header and hands Alice's session identifier to the next requester, who is now logged in as her. A well-known example was Valve's Steam store in December 2015, when a caching change served other users' account pages for about an hour. Browser caches matter too: after logout, the back button can reveal an account page unless no-store was set. This is informational because most CDNs bypass cache when they see Set-Cookie, but relying on that default is fragile.

State the intent explicitly on every personalised response. no-store is the safe choice for anything authenticated; private permits the user's own browser to cache but keeps shared caches out:

Cache-Control: no-store

Express, applied to authenticated routes:

app.use('/account', (req, res, next) => {
  res.set('Cache-Control', 'no-store');
  next();
});

nginx, for a dynamic location proxied to an application:

location /account/ {
    proxy_pass http://app;
    add_header Cache-Control "no-store" always;
}

Apache: Header always set Cache-Control "no-store" inside a <Location> block. Django sets Cache-Control: private on responses that touch the session and offers the @never_cache decorator; Rails expires_now sends no-store. On Cloudflare, the default caches only static extensions and bypasses responses carrying Set-Cookie; if you enable "Cache Everything", add a Cache Rule that bypasses cache when a session cookie is present. Keep long max-age values for genuinely static assets, which do not set cookies and are where caching belongs.