Re: Form passwords cached when redisplayed?

[markjugg]

I think I found in good answer in the docs for CGI.pm:

Some browsers, such as Internet Explorer, cache the output of CGI scripts. Others, such as Netscape Navigator do not. This leads to annoying and inconsistent behavior when going from one browser to another. You can force the behavior to be consistent by using the -expires parameter

-mark

[andye]

You can force the behavior to be consistent by using the -expires parameter

Unfortunately this doesn't work in all cases. Would that it did, it would make my life easier.

Even in mainstream browsers, the user can override the -expires parameter by fiddling around with the caching settings. It's never safe to assume that your page won't be cached.

andy.

[Anonymous Monk]

> Even in mainstream browsers, the user can override the -
> expires parameter by fiddling around with the caching
> settings.

That by itself might not be a big problem, I think. I have my browser set to cache everything, but this is my personal computer in my house that only I have access to, so it's not so much of a security problem for the password to be sent back in plain text. It could be trouble for a user who sets their browser to cache everything without understanding the security implications, though.