Question 1001

Someone Else's Dashboard

A team ships a signed-in dashboard that renders the current user's name, and the response carries only Cache-Control: max-age=300. A CDN sits between the browsers and the origin. What is the risk?

A

Only the origin's own cache is affected, since max-age is interpreted by the server and not by intermediaries

B

A shared cache is allowed to store and replay that response to other users, so the response needs private instead

C

Nothing, because the response sets a session cookie and shared caches always skip responses with Set-Cookie

D

Browsers will refuse to store it at all, because storage in any cache requires an explicit public