← Back to Baseline

MB-R350

HUMAN VERIFICATION REQUIRED ASVS 14.2.5 Web-cache-deception defense

MB-C18 ASVS Level 3 Human Assurance Medium

Caching mechanisms are configured to only cache responses which have the expected content type for that resource and do not contain sensitive, dynamic content. The web server should return a 404 or 302 response when a non-existent file is accessed rather than returning a different, valid file. This should prevent Web Cache Deception attacks.