[FIXED JENKINS-24337]

Added no-store to the Cache-Contorl header

Reference: http://stackoverflow.com/questions/866822/why-both-no-cache-and-no-store-should-be-used-in-http-response
Reference: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.2

changelog.html

@@ -55,7 +55,9 @@ Upcoming changes</a>
 <!-- Record your changes in the trunk here. -->
 <div id="trunk" style="display:none"><!--=TRUNK-BEGIN=-->
 <ul class=image>
-  <li class=>
+  <li class=rfe>
+    Added 'no-store' to the 'Cache-Control' header to avoid accidental information leak through local cache backup
+    (<a href="https://issues.jenkins-ci.org/browse/JENKINS-24337">issue 24337</a>)
 </ul>
 </div><!--=TRUNK-END=-->
 

core/src/main/resources/lib/layout/layout.jelly

@@ -54,7 +54,7 @@ THE SOFTWARE.
     </st:attribute>
   </st:documentation>
 <st:setHeader name="Expires" value="0" />
-<st:setHeader name="Cache-Control" value="no-cache,must-revalidate" />
+<st:setHeader name="Cache-Control" value="no-cache,no-store,must-revalidate" />
 <st:setHeader name="X-Hudson-Theme" value="default" />
 <st:setHeader name="X-Frame-Options" value="sameorigin" />
 <st:contentType value="text/html;charset=UTF-8" />