Direct answer
Caching can expose personalized content when responses are stored or reused outside their intended user context. Review cache eligibility, directives and actual behavior across browser, CDN and application layers.
Identify sensitive responses
List account pages, exports, authenticated API responses and other routes containing private test data. Map the browser, CDN, reverse proxy and application caches. Use two isolated test accounts with visibly different harmless records.
Reference: OWASP Web Cache Security Cheat Sheet.
Inspect directives and cache keys
Record the response's Cache-Control and related cache headers, and ask which request attributes the shared cache uses for its key. An appropriate directive must survive the actual edge and origin configuration; a header at one layer alone does not prove the final behavior.
- Exclude real personal data from test records.
- Verify redirects and error responses as well as successful pages.
- Coordinate cache tests to avoid affecting other users.
Compare two controlled users
With owner permission, fetch a personalized test response as account A and then the equivalent path as account B through the intended edge. Confirm B receives only B's data and inspect relevant cache diagnostics. Avoid cache poisoning tests against shared production traffic.
Retest and invalidate safely
Correct the route's cache policy or key using the owner's deployment process, purge affected entries where necessary and repeat both accounts. Verify public assets still cache as intended and that sensitive exports are handled under their own policy.
Assessment limits
A test of two accounts and one edge location does not prove every cache node, query variant or error response is safe. Cache invalidation can be disruptive and must be coordinated.
Frequently asked questions
Does HTTPS prevent a shared cache leak?
No. TLS protects transport, while a cache can still incorrectly store or reuse a response after terminating the connection.
Is a cache miss proof that a route is safe?
No. Repeated requests, different cache nodes or configuration changes may behave differently; inspect the policy and test the relevant delivery paths.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.