---
{
  "title": "Web cache security",
  "summary": "Separate public and personalized responses, align cache keys with response-changing inputs, and test permission changes through the real delivery path.",
  "topic": "networking",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [],
  "sources": [
    {
      "title": "OWASP: Web Cache Security",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Web_Cache_Security_Cheat_Sheet.html"
    }
  ],
  "editorialVersion": 2
}
---
## What it means

Web cache security ensures that a reused response is suitable for the request and person receiving it. Cache keys, response classification, and intermediary behavior determine whether personalized data or attacker-influenced content reaches unintended users. Authentication and caching need to be designed together.

## A practical example

A dashboard marks private responses appropriately and avoids sharing them across accounts. A public page's cache key includes the inputs that genuinely change its response, while untrusted headers cannot alter content behind an incomplete key.

## What to check

Identify which responses are public or personalized, inspect cache-control behavior at every layer, and test request variations. Review invalidation and cache behavior after permission changes.

## A common pitfall

Assuming a cookie or authorization header automatically prevents caching can be unsafe when intermediary configuration overrides normal behavior. A cache hit may skip application code that would otherwise authorize the request.

## Think it through

Why test the same URL with two user accounts through the CDN?

**Answer:** A shared cache may serve the first user's personalized response to the second if classification and keys are incorrect.

## A cache key defines a reuse decision

Imagine a fictional academy publishes public concept pages and private progress dashboards. Reusing one public article for many readers is useful. Reusing one learner's dashboard for another learner can disclose private information.

The cache key and eligibility rules determine which requests share a stored response. They must account for the inputs that actually change the representation. A request can be authenticated at the application while an incorrectly shared cached response bypasses that application's later decision.

## Follow the entire response path

Suppose the origin marks a dashboard private but an edge rule overrides the expected behavior. Inspect what the user receives through the CDN, reverse proxy, and application path. A local development test may not reproduce production caching.

Test with separate authorized lab accounts and clearly distinguish a cache miss from a hit. Do not assume the presence of a cookie or authorization header alone describes every intermediary's configured policy.

## Permission changes have a history

A learner might lose access after a role change while previously generated content remains in a cache. The design needs an appropriate invalidation or eligibility strategy for the sensitivity and lifetime of the response.

Likewise, a public page influenced by an untrusted request input can create a different risk if that input affects content but not the cache key. Review response variation and request normalization together instead of considering only user-specific data.

For a paper exercise, define a public article, a private dashboard, and a language-specific page. State which requests may share a response and which inputs must distinguish them. Add a permission revocation and describe how stale access is prevented or bounded. Then validate the intended behavior in a controlled environment through the actual delivery layer. The useful outcome is a defensible reuse policy, not simply an assumption that caching is either always safe or always dangerous.

## Related concepts

- [[http]]
- [[authorization]]
- [[api-security]]