SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Logout May Not Clear Browser Back-Forward Snapshots, Exposing Sensitive Pages

0
·2 views

Browsers' back-forward cache (bfcache) can keep a fully rendered page in memory so Back and Forward navigation appear instant. Because such a restored page may not be revalidated with the server, sensitive content can remain visible after a user has logged out. This poses a particular risk on shared devices, where a second person pressing Back may see the previous user's data before the application re-checks the session. Developers are advised to use Cache-Control: no-store on genuinely sensitive pages, since no-cache does not exclude pages from bfcache, and to combine this with server-side session revocation, client-side cleanup, and storage audits. The article stresses that no single measure is sufficient and that logout should be treated as a distributed state change across server, client, and browser.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Small nursing trial reports ChatGPT knowledge gain at six weeks, but its power to detect it is questioned

A pilot randomized trial with 32 undergraduate nursing students compared a ChatGPT-integrated teaching arm against a control on endotracheal suctioning knowledge. Scores were measured before, immediately after, and six weeks later, with the between-group difference reaching significance only at six weeks (p = 0.044). A reanalysis argues the design could reliably detect only much larger effects than the roughly 10-point gap reported. The authors' table header is also ambiguous about whether its intervals are interquartile or min-max ranges, which affects the estimated spread of scores. The trial was registered retrospectively, a point the paper itself acknowledges. The critique relies on the published figures and a power calculation rather than on new data collection.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Reviewing Pull Requests Using Git Diff and Surrounding Code Context

A guide recommends beginning a code review with the local git diff and then examining definitions, callers, and imports around each change rather than judging lines in isolation. It explains that a desktop tool opens the project structure first, then displays files in source, full comparison, or changes-only views with highlighted edits. The approach ties every finding to reproducible evidence, including static checks, tests, and schema drift, and treats model-only claims as hypotheses until verified. The article cautions that static analysis can miss dynamic loading, framework entry points, and external consumers, so unreferenced files are not automatically safe to delete. It suggests reviewing the changes-only view first, then heavily referenced files and their callers to gauge the blast radius before judging individual lines.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Microsoft's AI Frontiers research group disbanded as co-founder John Langford departs

Microsoft's AI Frontiers research group, which built the AutoGen agent framework and the Fara computer-use agent, has been dissolved. Co-founder John Langford announced his departure on November 6 and said the group's roughly 50 members were merged into Microsoft AI in early September. Langford attributed the split to a clash between a research-driven culture and Microsoft AI's focus on scaling larger models and training. The group also produced model research such as the Full Bandwidth Transformer, and AutoGen has already stopped receiving support from Microsoft. Developers relying on these tools are being advised to plan for their own maintenance and to avoid dependence on a single model provider.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Background AI agents stalled silently for hours with no errors, prompting new safeguards

A developer reports that two background agents each hung on a single shell command for roughly two and a half hours without raising an error or sending a completion notice. The stalls were caused by commands such as a permission-gated delete chain and a sleep-based wait loop, which block indefinitely instead of failing. To prevent this, the developer now bans sleep, until and while wait loops, and recursive force-delete commands in build briefs, and requires long jobs to run with timeouts or completion notifications. If an agent is quiet for about 30 minutes, the developer checks timestamps in its output and file modification times, and relaunches it from a progress file if both are stale. The approach depends on agents recording progress in a file from the start of each task.

0 comments Read more at DEV Community