Google is introducing a significant change to Chrome's Back/Forward Cache behavior, allowing web pages to be stored in the cache, even if a webmaster specifies not to store a page in the browser's cache.
"Bfcache is an in-memory cache that stores a complete snapshot of a page as the user is navigating away," explains Google's web.
"With the entire page in memory, the browser can quickly and easily restore it if the user decides to return."
Site admins can specify how their web pages are stored in a browser's cache using the "Cache-control:" header.
One option is to use the "Cache-control: no-store" header, which prevents the website response from being stored in the browser.
Browsers have not been storing webpages in bfcache if they use this header, causing performance issues when users return to those pages using the back and forward browser buttons.
Google proposes that webpages should be stored in the BFCache even when the "Cache-control: no-store" header is present on HTTPS pages.
Google engineer Fergal Daly says that the primary objective isn't to prevent the restoration of pages containing sensitive data.
Instead, the focus is to avoid restoring pages with sensitive data that the user should no longer have access to.
For sites using technologies like EventSource to reflect changes to open pages, these updates will trigger eviction from BFCache or deliver events promptly upon restoration.
Google is working on addressing these concerns by rolling out the feature to test channels first and getting enough data to understand the impact.
Some have raised concerns that this change could break promises to web developers who assume that the "Cache-control: no-store" header means the browser will not cache the webpage.
"Even if cache-control: no-store is being badly overused, and the numbers you list seem to indicate that is the case, hasn't there been a promise to web developers that such a resource will be forever gone once the page is no longer shown, and is that a promise that can reasonably be broken?".
"BFCache is not part of the HTTP caching, and developers should not interpret the CCNS header as a promise that the page will not be BFCached."
By redefining how BFCache interacts with the "Cache-control: no-store" directive, Google Chrome developers hope to create a more responsive browsing experience without compromising user security and privacy.
Google Chrome now auto-upgrades to secure connections for all users.
Google Chrome emergency update fixes 6th zero-day exploited in 2023.
Google shares plans for blocking third-party cookies in Chrome.
Google Chrome's new "IP Protection" will hide users' IP addresses.
Google Chrome's organize tabs will automatically reorder tabs.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Sat, 02 Dec 2023 16:50:18 +0000