Product ideas | Community
Skip to main content

Filter by idea status

10000 Ideas

Nelya-MNew Participant

AEMaCS Author: Prevent the caching of sensitive data in browserApproved

Request for Feature Enhancement (RFE) Summary: Prevent the browser caching of (potentially) sensitive data (e.g. some personal data of the logged-in user) Use-case: AEMaCS Author sets the Cache-Control header with a directive that does not prevent the caching of sensitive data in the user’s browser. An attacker gaining access to the browser of a user with which sensitive information has been retrieved can get insights into the data by reading the cache. Current/Experienced Behavior: The application does not prevent the caching of (potentially) sensitive data. In the responses, the value of the Cache-Control header is set to ”no-cache”, as can be seen in the following screen- shot (please check the attached report.) The “no-cache” instruction only ensures that the browser validates that the content is up-to-date on the server before using the cache. A look into the browser cache shows that sensitive data (e.g. some personal data of the logged-in user) is stored there. Improved/Expected Behavior: Set the following caching directives for any response which contains sensitive information. Pragma: no-cache Cache-Control: no-cache Cache-Control: no-store Most web browsers and proxy servers respect these directions and will not write data into their cache store. Environment Details (AEM version/service pack, any other specifics if applicable): AEMaCS Author Customer-name/Organization name:   Screenshot (if applicable):   Code package (if applicable):  

Rohan_Garg
Rohan_GargNew Participant

BPO Report - Cache Hit Ratio CalculationInvestigating

Request for Feature Enhancement (RFE) Summary: Would like the following feature - Cache Hit Ratio to be refined as a factor for Optimization in BPO Reports Use-case: We received a BPO Report highlighting Cache Hit Ratio of 80% against Adobe's recommendation of 90%.The implementation is AEMaaCS thus using Adobe's Fastly CDN. The metric is also calculated at CDN end. However, a large number of requests which are received at Dispatcher are not cache able. (Health Check based requests like /system/probes/health, /system/probes/live, /system/probes/ready and Bot Based Requests like GET /3x.php/?3x=3x which are blocked at Dispatcher) Current/Experienced Behavior: The metric calculated at CDN would take into account both bot based requests which are blocked at Dispatcher (but not CDN!) and Health Check based requests which are not cached and served to Publish instances via Dispatcher. Improved/Expected Behavior: The metric should exclude these service based requests (if not already done). Also, these bot requests should ideally be excluded from the data collected at CDN. (This might be possible only if these requests are blocked at CDN.) Environment Details (AEM version/service pack, any other specifics if applicable): AEMaaCS - Version - 2023.1 Customer-name/Organization name: TA Digital Screenshot (if applicable):   These logs are manually analyzed for 16th March 2023. Code package (if applicable):   @kautuk_sahni, @jagpreet_singh_