# Choose no-store when Cloudflare must not retain a sensitive response

> No-cache and no-store are different instructions, especially when Origin Cache Control is enabled.

- Canonical URL: https://update.dsesecurity.com/updates/choose-no-store-when-cloudflare-must-not-retain-a-sensitive-response/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:32+00:00
- Modified: 2026-10-20T18:34:35+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

No-cache and no-store are different instructions, especially when Origin Cache Control is enabled.

## Potentially affected

This concerns Cloudflare response caching directives.

## DSE recommendation

DSE recommends classifying authenticated, personalized, and public responses before adjusting cache policy.

## Article

No-cache and no-store are different instructions, especially when Origin Cache Control is enabled.

## Source facts

Cloudflare documents no-store as prohibiting storage of the request or response. No-cache instead requires validation before reuse and can allow cached storage when Origin Cache Control is enabled. Cache Rules can augment or override origin behavior, so the origin header is only part of the effective configuration. Private responses are intended for a single user rather than a shared cache.

Source: [Cloudflare — Origin Cache Control](https://developers.cloudflare.com/cache/concepts/cache-control/).

## Applicability

This concerns Cloudflare response caching directives.

## DSE recommendation

DSE recommends classifying authenticated, personalized, and public responses before adjusting cache policy. Use the storage restriction that matches the data-handling requirement and review matching Cache Rules for overrides. Keep browser caching and shared-edge caching decisions explicit. Avoid using no-cache as a synonym for never stored, and do not broaden a cache rule to fix performance without checking cookies and user-specific content. For each sensitive response class, ask the application owner to approve the intended storage behavior in plain language. Include a signed-out request after a signed-in request in the isolated test sequence, and make any cross-session content reuse an immediate stop condition for the proposed policy.

## Verification

With authorized test accounts, inspect origin and proxied response headers and the effective cache behavior across repeated requests. Compare anonymous and signed-in responses using separate sessions. Confirm sensitive content is not reused between users, and retain the rule configuration with the observations instead of treating a single MISS as proof of permanent non-storage.

## Official reference

[Cloudflare — Origin Cache Control](https://developers.cloudflare.com/cache/concepts/cache-control/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — Origin Cache Control
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/cache/concepts/cache-control/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose no-store when Cloudflare must not retain a sensitive response,” DSE Security, https://update.dsesecurity.com/updates/choose-no-store-when-cloudflare-must-not-retain-a-sensitive-response/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.