had a genuinely scary 20 minutes this morning. pushed a cache rule on cloudflare to speed up the member area and forgot the logged in pages were under the same path. for a short window the edge served one member’s dashboard to whoever hit it next. caught it because a user emailed saying he was looking at someone else’s billing name. killed the rule, purged everything, no sign it spread past the one person as far as i can tell. posting because i never see this talked about and i clearly didn’t think hard enough about it. how do you lot keep the cache off anything behind login?
Cache-Control: private, no-store on every authenticated response, set at the origin not the edge. Then you never rely on remembering a path rule. One middleware line and it covers every member route you ever add later.
The cleaner fix is a cookie check at the edge, bypass cache entirely when the session cookie is present. Path rules rot the second someone adds a new member route. Glad you caught it in 20 minutes, i have seen that exact bug run for days because the leaked page looked perfectly normal to everyone except the one person whose name was on it.
The part that would keep me up is not the cache rule, it is that the member area and the public area share a path at all. If they lived on separate hostnames a bad cache rule on the public side physically cannot touch logged in traffic. Costs you a subdomain and a bit of config, and buys you a wall instead of a thing you have to remember.
This. Origin headers are the source of truth and the edge should just obey them. The number of why is my logout button cached tickets i have closed by telling someone to stop setting cache headers in two places would depress you.
yeah the separate hostname thing is the real lesson here. its all one domain because i built it that way two years ago when it was just the public site, and the member stuff got bolted on later under the same roof. moving it is a weekend i didn’t want but after this morning its going on the list.
did almost the same thing years ago, except mine cached a password reset page and the token went with it. you got off light with a billing name. the no-store header is the belt, the separate hostname is the suspenders, run both and stop trusting yourself to remember a path.