[Security] Incomplete or No Cache-control and Pragma HTTP Header Set, Rank: Medium-Low

Platform: Desktop and Mobile

Environment: Staging

Description of issue: The cache-control and pragma HTTP header have not been set properly or are missing allow the browser and proxies to cache content. Even after the session has been closed, there are cases where its possible to access private or sensitive data exchanged within the session through the web browser cache.

***This security issue is considered low priority, as its not cache-control is not caching any sensitive data.

*****There is one or more URL that might be a medium priority, since its caching metadata containing the organizations' profile. (Example: https://staging.fightpandemics.work/api/organisations/5f13de65deb46c00130ea5b4)

Vulnerable URLs:
*****https://staging.fightpandemics.work/api/organisations/5f13de65deb46c00130ea5b4
***https://staging.fightpandemics.work/cookies-policy
***https://staging.fightpandemics.work/static/media/comment.59e1bd19.svg
***https://staging.fightpandemics.work/static/media/figmaLogo.bfc8530d.svg
***https://staging.fightpandemics.work/static/media/hackoladeLogo.006b6134.svg
***https://staging.fightpandemics.work/static/media/social-twitter-unfilled.63c3650b.svg
***https://staging.fightpandemics.work/static/media/linkedin.aa80ba20.svg
***https://staging.fightpandemics.work/static/media/twilio-logo.6d37b725.svg
***https://staging.fightpandemics.work/static/media/menu.42055224.svg
***https://staging.fightpandemics.work/static/media/miro-logo.65b54d9e.svg
***https://staging.fightpandemics.work/static/media/help-gesture-unselected.116b5eeb.svg
***https://staging.fightpandemics.work/static/media/akveoLogo.42d57c0e.svg
***https://staging.fightpandemics.work/static/media/gitkraken-logo.927cb42c.svg
***https://staging.fightpandemics.work/static/media/envelope.069590ba.svg
***https://staging.fightpandemics.work/static/media/share-gray.b376aa2d.svg
***https://staging.fightpandemics.work/static/media/zeplin-logo.9670b0cf.svg
***https://staging.fightpandemics.work/static/media/auth0-logo.480b11f8.svg
***https://staging.fightpandemics.work/static/media/mongodb-logo.9fb7790a.svg
***https://staging.fightpandemics.work/static/media/sentry-logo.4c0de1be.svg
***https://staging.fightpandemics.work/static/media/facebook.db69789c.svg

Replicate issue:
1. Depending on the browser, use the debugger tool (Usually can be open with F12 key).
2. Click on Headers
3. Input and load any of the URLs above
4. Check the Response Headers
5. Notice the following: cache-control: max-age=0

Solution: Whenever possible ensure the cache-control HTTP header is set with no-cache, no-store, must-revalidate; and that the pragma HTTP header is set with no-cache.

References:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching
https://www.imperva.com/learn/performance/cache-control/