It is a good programming practice to prevent Caching of sensitive data at client or proxies by implementing:
-
"Cache-Control: do not-cache, do not save"
-
"Cache-Control: do not-save, do not store"
-
"Cache-Control: no-cache, no store"
-
"Cache-Control: do not cache"
To solve this question, the user needs to know about caching and how to prevent sensitive data from being cached on clients or proxies.
Option A: "Cache-Control: do not-cache, do not save" - This option is not entirely correct. Although the "do not-cache" directive will prevent the client or proxy from caching the data, there is no "do not save" directive in the Cache-Control header field.
Option B: "Cache-Control: do not-save, do not store" - This option is incorrect. There is no "do not-save" or "do not store" directive in the Cache-Control header field.
Option C: "Cache-Control: no-cache, no store" - This option is correct. The "no-cache" directive indicates that the client or proxy should not use a cached copy of the data for subsequent requests, but it should revalidate the data with the origin server. The "no-store" directive indicates that the client or proxy should not store the data in any form of cache. Together, these directives ensure that sensitive data is not cached on the client or proxy.
Option D: "Cache-Control: do not cache" - This option is not entirely correct. The "do not cache" directive will prevent the client or proxy from caching the data, but it does not prevent the data from being stored in other forms of cache.
Therefore, the correct answer is:
The Answer is: C
The HTTP header Cache-Control: no-cache, no-store tells browsers and intermediate proxies not to cache the response and not to store it at all, which is exactly what's needed to prevent sensitive data (like account details or session tokens) from lingering in a cache where it could later be retrieved by another user or process. The other options use non-standard directive names (do not-cache, do not-save) that aren't recognized HTTP cache-control directives.