topic
Verified 2026-09-18Cache Poisoning and Cache Keys
A cache can serve a response to the wrong request when its key omits an input that changed the response.
Keep cache keys aligned with response variation, use Vary where required, normalize host and forwarded headers at trusted boundaries, and never cache personalized content as shared content by accident.
httpcachesecurityproxy
Reference (http)
Vary: Origin, Accept-Encoding Cache-Control: private
Keep cache keys aligned with response variation, use Vary where required, normalize host and forwarded headers at trusted boundaries, and never cache personalized content as shared content by accident.
Common mistakes
- Testing only the origin response and ignoring CDN, browser, or intermediary cache-key behavior.