General Security

mikotondria

Hey, folks..
Just a general question really...
I have a series of dynamic forms on my site, that collect data and store it in a customers' record set, and also retrieves that info when the customer logs back in, and populates the previously entered form elements..
I am wondering what I can/need to do to ensure that no info is left on the computer that has been used to do this - ie I need the set up to be as non-persistent as possible, nothing in the cache and so on..
Can I simply put a 'pragma - nocache' in my header and be confident that no 'evidence' is being left, and that a subsequent user of the machine would not be able to know that the form completing had gone on ?
Any advice around this issue would be great, also.
Many thanks and a very happy new year to all.
Mike.,

Roger_Ramjet

I use this set of headers to disable cache.

<?php		//header.php
//disable all browser caching MUST BE FIRST LINES WITH NO PRECEEDING SPACES ETC
// Date in the past
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");

// always modified
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");

// HTTP/1.1
header("Cache-Control: no-store, no-cache, must-revalidate");
header("Cache-Control: post-check=0, pre-check=0", false);

// HTTP/1.0
header("Pragma: no-cache");

?>

But even that will not stop proxies if they have been set to ignore server cache directives. It will stop most browsers from caching your docs though.

PS I got this code here a long time ago so I don't know whom to credit.

mikotondria

Hey cool, thanks for that, Roger 🙂..

Take care,
Mike.

mikotondria

ok, so cool - Now I know that the data/pages will not be cached..

Its important on this project that someone using the machine after the client cannot tell that there has been activity on this site..
I suppose theres nothing I can do to stop the browser putting the pages into the history, is there ?

Also, with the wonders of Firefox et al auto-completing the fields, is there anything I can do to stop old data showing in other forms on other sites whose fields have the same 'name=' as the fields on my forms, other then just giving them really obsure names that would never come up elsewhere ?

Any thoughts greatly appreciated.
Thanks again, each.

rehfeld

using ssl would minimize how much data the browser stores

Roger_Ramjet

Autofill matches the URL before filling in input, so it won't display it on another pag. You cannot delete the history, it is read-only. Which does not mean that you could not accompllish something with a Java applet.

mikotondria

ah, cool - yeah, you're right there - thanks. 🙂..
I suppose I can only do whats possible and at least provide the user with a comprehensive guide on how to clear cache/history/cookies from various browsers - I think that should cover it, I just really wanted to get as much info on what I could do from this end to make it as non-persistent as poss.
Thanks, guys.
Anyone else got any info/resources on this subject area that might be useful ?