Caching interview question · Most asked
How can a CDN leak one user's data to another, and how do you prevent it?
Summary
If a personalized response lacks Cache-Control: private, no-store (or the CDN ignores origin headers), the shared cache stores it by URL and serves it to the next visitor. Mark personalized responses private, make the CDN respect headers, and don't cache responses with Set-Cookie/Authorization.
Longer Answer
Split pages into a shared, cacheable shell and client-loaded personalized parts; add automated checks that authenticated endpoints return private/no-store.
Key Points
- Shared caches key by URL
- private, no-store for personal data
- CDN must respect origin headers
Deep dive: Database Caching at Scale
More most-asked Caching questions
- How does HTTP caching work (Cache-Control, ETag, CDNs)?
- Explain the difference between cache penetration, cache breakdown and cache avalanche.
- In cache-aside, why can a value be stale even though you delete the key on every write?
- Why is cache invalidation hard, and what strategies help?
- Explain the main caching patterns: cache-aside, read-through, write-through and write-behind.
- What is a cache stampede (thundering herd) and how do you prevent it?
- How does stale-while-revalidate work, and when is it inappropriate?
- How do you design good cache keys?