0

Add Clear-Site-Data header to logout page

noc il y a 4 jours 0

OWASP recommends adding a Clear-Site-Data header to logout pages, to suggest browsers should clear the site's data. See https://owasp.org/www-project-secure-headers/#clear-site-data

This could be implemented pretty easily in `front/logout.php` by adding a single line:

header('Clear-Site-Data: "cache", "cookies", "storage"');

(We'll be doing this modification on our local install due to a pentest report which recommends it, and apache makes adding the header difficult due to the 302 redirect)