Route returns PCI regulated data without setting Cache-Control HTTP header
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Description
This publicly exposed API endpoint returns PCI regulated data without implementing the Cache-Control header. This header instructs browsers how to cache HTTP responses. Without this header, sensitive API responses might be cached inappropriately, potentially exposing regulated data to unintended users through shared browsers.
What are considered payment card industry (PCI) data?
It refers to any sensitive information associated with payment cards that must be protected under the PCI Data Security Standard (PCI DSS).
The standard ensures that businesses handling payment data implement security measures to protect against fraud and breaches.
This data includes credit cards, bank account numbers, security code (CVV/CVC), expiration date, etc.
Note: Datadog is only able to detect certain types of PCI data.
Implement the Cache-Control header in all API responses. Use the ’no-store’ value to prevent caching of sensitive data.
Example header values:
