Caching Settings Control

Recommended Configuration

• Enable secure and persistent browser caching to improve performance
• Enable Content Delivery Network (CDN) for Lightning Component framework
• Enable Remember me until logout

On the Session Settings Setup page, in the Caching section, select Enable Content Delivery Network (CDN) for Lightning Component framework and Remember me until logout

Control Name

Caching Settings

Control Overview

This configuration optimizes platform performance and user convenience by using a global Content Delivery Network (CDN) and secure browser caching to accelerate the delivery of static Lightning resources. To further streamline the daily workflow, the "Remember me" feature persists the user’s identity across sessions, reducing login friction until an explicit logout is performed.

Security Risk If Not Configured

Failure to enable these performance and session optimizations risks a significant decrease in platform responsiveness and user productivity due to increased latency and redundant server requests. Furthermore, the absence of persistent caching and streamlined authentication creates a high-friction environment that can lead to user fatigue and potential adoption hurdles across distributed teams.

Threat Scenarios

By neglecting these security controls, you risk a "session leakage" scenario where sensitive Lightning component data is stored insecurely in the browser, potentially allowing unauthorized users on shared devices to harvest information from the cache. Furthermore, without the CDN's origin shielding and the "Remember me until logout" guardrail, the org becomes more susceptible to performance-driven outages and unauthorized access via abandoned workstations, as sessions may not invalidate as strictly as required for high-security environments.

Estimated CVSS Score Range

Critical (9.0–10.0).

Risk Impact Considerations

User working environment, user profiles, and data access.

Higher Risk When

Without these enabled, sensitive UI component data is cached in an unencrypted state on the user's local disk, while the absence of a hardened CDN and strict "Remember me" logic prevents the org from effectively isolating resource delivery and ensuring sessions are invalidated upon browser closure. This combination elevates the risk of unauthorized data harvesting from shared hardware and successful session hijacking attempts.

Low or No Risk When

To minimize the risks of performance degradation and user friction, companies can implement Single Sign-On (SSO) to streamline the frequent re-authentication process and enforce rigorous code optimization to reduce the initial payload size of custom components. Also, maintaining a high-bandwidth, low-latency network infrastructure can partially offset the lack of CDN-driven delivery and persistent local caching.

Business and Integration Considerations

Location of users, including integration users, user endpoints.

Recommended Remediation

Enable secure caching settings.

Security Health Review Guidance

Security Health Review inspects the caching controls based on the best practice ensure secure caching of sensitive data while maintaining caching capability to improve performance.