Caching interview question · Most asked
What are the risks of caching personalized or authorized data?
Summary
If cache keys or HTTP caching rules don't include the user, tenant or permissions, one user's data can be served to another, a serious data leak. CDNs caching authenticated responses are a common source of such incidents.
Longer Answer
Mark personalized responses Cache-Control: private or no-store, include tenant/user in application cache keys, and test cache behavior with multiple users.
Key Points
- Keys must include identity
- private/no-store for user data
- Beware CDNs on authenticated routes
- Test with multiple users
More most-asked Caching questions
- Explain the main caching patterns: cache-aside, read-through, write-through and write-behind.
- Why is cache invalidation hard, and what strategies help?
- What is a cache stampede (thundering herd) and how do you prevent it?
- How does HTTP caching work (Cache-Control, ETag, CDNs)?
- Explain the difference between cache penetration, cache breakdown and cache avalanche.
- In cache-aside, why can a value be stale even though you delete the key on every write?
- How can a CDN leak one user's data to another, and how do you prevent it?
- How does stale-while-revalidate work, and when is it inappropriate?