October 13, 2026 路 #27
Someone else's dashboard
A CDN caches every 200 from /account based on the URL, for 10 minutes. What do you change?
Next puzzle in UTC
One try. The first answer sticks.
How to fix it
A URL-only cache key shares the first user's response with everyone else. Mark authenticated responses private and bypass the edge cache when a credential header is present.
/account returns different HTML per person. A cache that keys only on the path stores the first 200 and hands it out for ten minutes. The next visitor gets the first visitor's invoices, email, and session details rendered into the page. Gzip does not partition the cache. Putting the user's name in an HTML comment makes the leak easier to spot and does not prevent it.
Cache-Control: private, no-store tells a conforming cache not to reuse the response. You still want the CDN rule, because a single missing header on one route should not become an incident. Bypass when Cookie or Authorization is present, or when the path is under /account.
Fix
Cache the anonymous shell, the CSS, and the images. Do not cache the document that includes a session. If you must cache personalized data, vary on a private identifier and still send private. Audit cache keys the same way you audit IAM: the default should be "do not store this."