WEB / WEB-09.S01

Cache keys, Vary, and personalized content

A fresh entry can still have the wrong variant or audience. Follow public catalog language, freshness, and personal bypass as distinct decisions.

CORE · RED · BLUE · ARTIFACT · PRACTICE

Read every scenario without motion

Public HIT

Request facts supplied
The GET catalog request selects en and a supplied public classification. Its stored candidate is en with age 8/lifetime 60. These are local-calculator inputs; neither the HIT decision nor browser delivery has occurred.
Request facts
GET catalog; language en; public
Stored public entry
Public en entry; age8; lifetime60
Reuse decision
No decision
Delivery selection
No body selected
Select reuse profile
The public-only profile evaluates request class; selecting a key or class is local, not a network hop.
Request facts
Profile facts ready; public; en
Stored public entry
Public en entry; age8; lifetime60
Reuse decision
Candidate evaluation pending
Delivery selection
No body selected
Read candidate facts
Read the stored public entry’s language, audience, and age together; no message is sent to another owner.
Request facts
Profile facts ready; public; en
Stored public entry
Candidate: public; en; age8
Reuse decision
Candidate facts ready
Delivery selection
No body selected
Matching and reuse decision
Selected policy uses distinct reasons for a different variant, stale entry, and personal class, without inventing a new origin body.
Request facts
Request public; en
Stored public entry
Candidate: public; en; age8
Reuse decision
HIT; matching-public-fresh
Delivery selection
No body selected
Delivery selection result
Public classification, en/en variant matching and freshness 8<60 yield HIT. Atlas catalog is selected from the local entry; originAction is none. Selection is not evidence of actual browser delivery.
Request facts
Request public; en
Stored public entry
Candidate: public; en; age8
Reuse decision
HIT; matching-public-fresh
Delivery selection
Selected: Atlas catalog; none

Variant MISS

Request facts supplied
The GET catalog request asks for tr while the stored public candidate is en. Age 8/lifetime 60 cannot erase that language difference. Local reuse is still undecided; no new origin body has been fetched.
Request facts
GET catalog; language tr; public
Stored public entry
Public en entry; age8; lifetime60
Reuse decision
No decision
Delivery selection
No body selected
Select reuse profile
The public-only profile evaluates request class; selecting a key or class is local, not a network hop.
Request facts
Profile facts ready; public; tr
Stored public entry
Public en entry; age8; lifetime60
Reuse decision
Candidate evaluation pending
Delivery selection
No body selected
Read candidate facts
Read the stored public entry’s language, audience, and age together; no message is sent to another owner.
Request facts
Profile facts ready; public; tr
Stored public entry
Candidate: public; en; age8
Reuse decision
Candidate facts ready
Delivery selection
No body selected
Matching and reuse decision
Selected policy uses distinct reasons for a different variant, stale entry, and personal class, without inventing a new origin body.
Request facts
Request public; tr
Stored public entry
Candidate: public; en; age8
Reuse decision
MISS; variant-mismatch
Delivery selection
No body selected
Delivery selection result
The tr/en mismatch yields MISS with variant-mismatch and bodySelected null. fetch-required-not-executed identifies the needed origin request without claiming a fetch or a received body.
Request facts
Request public; tr
Stored public entry
Candidate: public; en; age8
Reuse decision
MISS; variant-mismatch
Delivery selection
Selected: null; fetch-required-not-executed

Stale validation

Request facts supplied
Request and public entry both select en, but this branch has age and lifetime both 60. The local calculator will evaluate the freshness boundary; no validation request or successful origin response exists.
Request facts
GET catalog; language en; public
Stored public entry
Public en entry; age60; lifetime60
Reuse decision
No decision
Delivery selection
No body selected
Select reuse profile
The public-only profile evaluates request class; selecting a key or class is local, not a network hop.
Request facts
Profile facts ready; public; en
Stored public entry
Public en entry; age60; lifetime60
Reuse decision
Candidate evaluation pending
Delivery selection
No body selected
Read candidate facts
Read the stored public entry’s language, audience, and age together; no message is sent to another owner.
Request facts
Profile facts ready; public; en
Stored public entry
Candidate: public; en; age60
Reuse decision
Candidate facts ready
Delivery selection
No body selected
Matching and reuse decision
Selected policy uses distinct reasons for a different variant, stale entry, and personal class, without inventing a new origin body.
Request facts
Request public; en
Stored public entry
Candidate: public; en; age60
Reuse decision
VALIDATE; matching-stale
Delivery selection
No body selected
Delivery selection result
The matching entry at age=lifetime=60 yields VALIDATE and bodySelected null. validation-required-not-executed is not successful validation. This profile neither selects stale content nor invents an origin response.
Request facts
Request public; en
Stored public entry
Candidate: public; en; age60
Reuse decision
VALIDATE; matching-stale
Delivery selection
Selected: null; validation-required-not-executed

Personal bypass

Request facts supplied
The request selects Duru’s personal /notes/mine route. This public-only profile will bypass shared lookup first. The supplied classification is not a login test; origin policy has not run.
Request facts
GET /notes/mine; personal
Stored public entry
Public en entry; age8; lifetime60
Reuse decision
No decision
Delivery selection
No body selected
Shared lookup skipped
A personal class falls outside the public-only profile, so shared lookup is skipped; selecting origin policy is not yet an HTTP call.
Request facts
Profile facts ready; personal; en
Stored public entry
Public entry unchanged; lookup skipped
Reuse decision
Candidate evaluation pending
Delivery selection
No body selected
Shared entry remains unchanged
No public-candidate lookup occurs for the personal request; the existing shared body and metadata remain unchanged.
Request facts
Profile facts ready; personal; en
Stored public entry
Public entry unchanged; lookup skipped
Reuse decision
Personal bypass selected
Delivery selection
No body selected
Matching and reuse decision
Selected policy uses distinct reasons for a different variant, stale entry, and personal class, without inventing a new origin body.
Request facts
Request personal; en
Stored public entry
Public entry unchanged; lookup skipped
Reuse decision
BYPASS; personal-outside-public-profile
Delivery selection
No body selected
Delivery selection result
The personal route yields BYPASS and personal-outside-public-profile without selecting shared content. origin-policy-required-not-executed names the next responsibility, not a user denial or successful origin authorization.
Request facts
Request personal; en
Stored public entry
Public entry unchanged; lookup skipped
Reuse decision
BYPASS; personal-outside-public-profile
Delivery selection
Selected: null; origin-policy-required-not-executed

ACTORS · STATE · DATA FLOW

Which requests does a cache key consider equivalent?

Atlas can show its public catalog in Turkish and English. Two requests can use the same URL while selecting different representations. A key defines equivalence when choosing a reusable response; it is not an arbitrary string added only for speed. This lesson’s selected profile retains GET, the complete public target URI, and Accept-Language together.

Removing a distinction that affects response selection can make different representations appear to share one candidate entry. The example uses harmless catalog language only. Different query strings or authorities are not treated as equal, and the profile silently drops no query parameter. This bounded formatter is not a general HTTP canonicalization parser.

Vary requests matching of named request headers

The origin uses Vary: Accept-Language to identify that request header as a selection dimension. An entry obtained for en is not a matching candidate for tr here. Vary verifies no identity and grants no authorization. Names come from response metadata; compared values come from the original and new requests.

This profile handles only fixed tr/en values and absence. An absent header matches absence, and a Vary member * prevents matching reuse. General field-value normalization depends on that field’s semantics. The profile does not lowercase every header value and assume semantic equality.

Matching, fresh, and public are separate gates

The normal fixture selects en for both request and stored entry, current_age=8, lifetime=60, and public audience. Together these facts satisfy this profile’s HIT decision. Changing the request to tr can leave the entry fresh while variant matching fails. Freshness cannot make the wrong representation belong to the correct audience.

At age60/lifetime60, the variant can match while the selected strict profile requires validation. This profile does not serve stale responses; that does not forbid every stale-use option in HTTP. Age is an observation calculation, not a version validator or certificate of business-record correctness. Obtaining a new response belongs to the HTTP flow outside this local model.

Personalized and tenant-scoped content

The fixture bypasses shared lookup first for Duru’s personal note. Observing a session cookie, an Authorization header, and an origin-produced personal representation are different facts. The profile never treats a client-written tenant or role as trusted public classification; its route/audience information is supplied validated policy input.

Adding a tenant to a public cache key cannot replace record authorization. A correctly partitioned key does not repair a response already delivered to the wrong scope. Atlas keeps personal responses outside shared storage here. Unqualified private and no-store impose different storage boundaries; the selected personal policy uses private, no-store.

Why distinguish poisoning from deception?

Cache poisoning concerns an inappropriate or corrupted response becoming reusable for later users. Cache deception concerns sensitive or dynamic content entering shared storage through incorrect classification. Assuming a cached body is trustworthy skips a boundary in either case; consequences and the faulty decision point differ.

This lesson generates no attack request. An inert policy-conflict record declares a public routeClass and personal representationAudience. The independent guard rejects storage/delivery when those trusted declarations conflict. It demonstrates the required invariant without executing an HTTP parser discrepancy or reproducing a vulnerability.

A decision record should retain its boundaries

The artifact separates decision, reason, bodySelected, and originAction. On MISS, bodySelected is null rather than an invented new origin body. The same applies to VALIDATE. BYPASS is not a user denial here; it leaves shared reuse for origin policy.

Missing request evidence yields not-computed, not a certificate of a clean cache or safe system. Observations need no raw session credential, personal note, or access token. Representation class and bounded decision information suffice to explain this model’s boundary.

Read every scenario without motion

Variant mismatch

Stored language was separated from requested language
The entry for GET https://books.example/catalog has language en, public audience and body Atlas catalog. The new request language is tr. Vary selects accept-language; these ordinary catalog views are not one variant.
Candidate facts
Stored en / request tr / public target
Reuse policy gate
Gate pending
Body/audience boundary
No body selected
Freshness did not repair a key mismatch
Even with age 8 and lifetime 60, variant mismatch produces MISS. Shortening TTL does not repair the language-key problem. Equal target and method do not prove matching selected-request-header dimensions.
Candidate facts
Stored en / request tr / public target
Reuse policy gate
Fresh but variant mismatch / MISS
Body/audience boundary
No body selected
Shared content was not selected for the wrong variant
bodySelected stays null and originAction is fetch-required-not-executed. The local model performs no fetch. A required next action is not an obtained representation; the missing body is not filled with the en copy.
Candidate facts
Stored en / request tr / public target
Reuse policy gate
Fresh but variant mismatch / MISS
Body/audience boundary
MISS / body null / fetch not executed
A stale ordinary candidate had another reason
The stale case matches language en but age 60 equals lifetime 60. staleServing is false in this profile. It requires VALIDATE despite a matching key; variant MISS and freshness failure retain different reasons.
Candidate facts
Matching en / age60 / VALIDATE
Reuse policy gate
Fresh but variant mismatch / MISS
Body/audience boundary
MISS / body null / fetch not executed
Required validation was not a successful origin result
The stale case has bodySelected null and originAction validation-required-not-executed. That is neither an actual origin round trip nor a 304. The reuse gate only identifies the required next flow.
Candidate facts
Matching en / age60 / VALIDATE
Reuse policy gate
Stale: body null / validation not executed
Body/audience boundary
MISS / body null / fetch not executed
Key and freshness scope did not become user policy
Ordinary variant and stale decisions are explicit in this conservative public-only profile. General header normalization and actual authorization are not calculated. A key dimension does not replace identity; even a HIT is not a user grant.
Candidate facts
Matching en / age60 / VALIDATE
Reuse policy gate
Stale: body null / validation not executed
Body/audience boundary
Reuse scope known / identity-authority separate

Audience conflict

Trusted declarations retained their audiences
policyConflict supplies routeClass public and representationAudience personal. Route appearance conflicts with body audience. URL classification alone cannot establish that a representation is public.
Candidate facts
Route public / representation personal
Reuse policy gate
Gate pending
Body/audience boundary
No body selected
The conflict was rejected before storage selection
The inert conflict yields REJECT with bodySelected null. Response production and storage policy must use the same approved classification. A public-route label does not silently erase a personal-audience declaration.
Candidate facts
Route public / representation personal
Reuse policy gate
REJECT / conflicting audience / body null
Body/audience boundary
No body selected
Rejection was not presented as a disclosure event
This record demonstrates a guarded outcome without reading another user’s content or altering an entry. Wrong-recipient delivery is a potential impact, but the counterexample is not evidence of a real disclosure.
Candidate facts
Route public / representation personal
Reuse policy gate
REJECT / conflicting audience / body null
Body/audience boundary
Guarded conflict / no disclosure observed
The ordinary personal route was separated from conflict
The personal case addresses https://books.example/notes/mine with class personal and language en. It yields BYPASS for personal-outside-public-profile. A known personal route and contradictory declarations are different conditions.
Candidate facts
Personal route / BYPASS / body null
Reuse policy gate
REJECT / conflicting audience / body null
Body/audience boundary
Guarded conflict / no disclosure observed
BYPASS required independent origin policy
originAction is origin-policy-required-not-executed and no shared body is selected. Being outside the public profile is neither rejection nor authenticated allowance. Tenant isolation, object authorization and partitioning remain separate gates.
Candidate facts
Personal route / BYPASS / body null
Reuse policy gate
Origin policy required / not executed
Body/audience boundary
Guarded conflict / no disclosure observed
Classification control retained its runtime boundary
The typed conservative guard covers local candidates only. Actual edge parsers, CDNs, credentials and tenant enforcement are unmeasured. Distinguishing conflict rejection from personal bypass identifies the owner needing further evidence.
Candidate facts
Personal route / BYPASS / body null
Reuse policy gate
Origin policy required / not executed
Body/audience boundary
REJECT ≠ BYPASS / actual enforcement unmeasured

ASSUMPTION · BOUNDARY · CONTROL

Review equal-URL results through separate decisions

A cached 200 establishes neither audience nor representation correctness. Ask which method, target, and selected request header produced the public entry. Does the next request match that key, and is the response reusable? The fixture’s en-to-tr comparison uses two ordinary catalog views.

Shortening a TTL does not fix selecting a fresh entry for the wrong variant. A matching key also does not remove the stale branch’s validation requirement. Keep key mismatch and freshness failure as distinct reasons; one generic “bad cache” label hides the responsible decision.

A trusted key dimension is not a client’s claimed identity. This lesson resolves no credential in the personal branch. Reading its supplied allowed context as authentication evidence would invent a security check the model never performed.

Are classification and representation consistent?

The inert conflict record disagrees on public routeClass and personal audience. Review where that disagreement is resolved: response production and storage policy should use the same approved classification. URL appearance alone does not determine audience.

Connect poisoning/deception to integrity and confidentiality consequences rather than a request recipe. This counterexample produces a guarded result without reading another user’s data or corrupting an entry. Passing the native typed guard validates no real edge parser, tenant policy, or provider cache.

Read every scenario without motion

Decision matrix

The public matching candidate became the positive control
The producer is a local typed reuse function comparing request facts with a stored entry. decision/reason/bodySelected/originAction belong to one candidate, not a real cache access log. MISS, VALIDATE and BYPASS identify unexecuted work rather than results received from the next owner. Normal en/en, age 8 and public class yield HIT, matching-public-fresh and Atlas catalog. Origin action is none. Body selection and reason are reviewed together; status 200 alone is insufficient.
Candidate matrix
HIT / matching-public-fresh / Atlas catalog
Independent decision review
Gate pending
Evidence verdict
No body selected
Three non-HIT outcomes retained separate expectations
tr/en MISS, age60 VALIDATE and personal BYPASS have different decisions and reasons, each with bodySelected null. Equal null bodies alone do not identify the required next owner flow.
Candidate matrix
HIT / matching-public-fresh / Atlas catalog
Independent decision review
MISS / VALIDATE / BYPASS: body null
Evidence verdict
No body selected
Origin action was not written as an executed outcome
fetch-required-not-executed, validation-required-not-executed and origin-policy-required-not-executed identify next needs. They are not actual network responses, validation successes or authenticated-policy results.
Candidate matrix
Required next actions / no origin execution
Independent decision review
MISS / VALIDATE / BYPASS: body null
Evidence verdict
No body selected
Conflict and no computation matched different predicates
Public/personal conflict yields REJECT. With missingEvidence request null, the result is NOT-COMPUTED. Guard rejection and insufficient input for a guard are different evidence.
Candidate matrix
Required next actions / no origin execution
Independent decision review
Conflict REJECT / missing request NOT-COMPUTED
Evidence verdict
No body selected
Matrix consistency was not general cache correctness
This profile uses fixed tr/en or explicit-absence inputs. It does not implement general HTTP-cache grammar, distributed replication or deployment purging. A native typed-function run is not a real browser/CDN-policy result.
Candidate matrix
Required next actions / no origin execution
Independent decision review
Conflict REJECT / missing request NOT-COMPUTED
Evidence verdict
Finite profile consistent / general runtime unmeasured
Regression preserved body-metadata association
Stored body, Vary, audience, age and lifetime remain tied to one candidate. A metadata change must not import another body’s classification. Scoped fields and reasons may suffice without logging full personal content.
Candidate matrix
Required next actions / no origin execution
Independent decision review
Conflict REJECT / missing request NOT-COMPUTED
Evidence verdict
Recheck candidate/body/Vary/audience/age

Missing request

An absent input was not treated as an ordinary en request
The producer is a local typed reuse function comparing request facts with a stored entry. decision/reason/bodySelected/originAction belong to one candidate, not a real cache access log. MISS, VALIDATE and BYPASS identify unexecuted work rather than results received from the next owner. missingEvidence has request null. The stored entry’s language en does not imply that a new request uses en. Guessing a default HIT would select a body without request evidence.
Candidate matrix
Request null / stored entry still en
Independent decision review
Gate pending
Evidence verdict
No body selected
The gate produced no decision without input
The result is NOT-COMPUTED with safeSystemClaim false. It is neither REJECT, MISS nor a safe HIT. A separate coverage outcome prevents mislabeling ordinary policy branches.
Candidate matrix
Request null / stored entry still en
Independent decision review
NOT-COMPUTED / safeSystemClaim=false
Evidence verdict
No body selected
A complete fixture did not fill the incomplete review
The normal case’s en/en and age 8 cannot replace another observation. The fixture provides a teaching expectation; request source and actual selected-header coverage remain necessary.
Candidate matrix
Normal fixture is not missing-request evidence
Independent decision review
NOT-COMPUTED / safeSystemClaim=false
Evidence verdict
No body selected
Required key dimensions retained an explicit inventory
This profile needs method, complete target URI and selected language. Absent fields and unsupported values are not guessed into defaults. Reuse predicates cannot be evaluated before the input inventory exists.
Candidate matrix
Normal fixture is not missing-request evidence
Independent decision review
Needed: method/complete target/language
Evidence verdict
No body selected
Body selection and safety claims remained withheld
Without request coverage, no body is selected and no claim is made that every system branch is safe. A missing row establishes neither successful enforcement nor a confidentiality violation.
Candidate matrix
Normal fixture is not missing-request evidence
Independent decision review
Needed: method/complete target/language
Evidence verdict
No body conclusion / safety unknown
New evidence was scoped to the minimum request facts
Further review requires method, canonical target, selected language and trusted class, not credentials or private-note bodies. With new facts, decision and body selection are recalculated together.
Candidate matrix
Normal fixture is not missing-request evidence
Independent decision review
Needed: method/complete target/language
Evidence verdict
Collect minimal facts, then recompute candidate

IMPLEMENTATION · SECURITY CONTROL · VERIFICATION

Define an approved reuse profile

The producer is a local typed reuse function comparing request facts with a stored entry. decision/reason/bodySelected/originAction belong to one candidate, not a real cache access log. MISS, VALIDATE and BYPASS identify unexecuted work rather than results received from the next owner. Define the public representation set first: only the GET public catalog here. Preserve the complete target URI and selected-language match. The dimension named by Vary and the origin-selected variant should belong to one contract. Use explicit decisions for absent or unsupported values instead of guessed defaults.

Do not automatically admit personal or unclassified representations into a public cache. This profile uses bypass and private, no-store for the personal route. Tenant isolation, object authorization, and cache partitioning are separate controls; adding a tenant prefix does not replace them.

Keep a stored body with its Vary, audience, age, and lifetime. Updating metadata should not silently attach another body’s classification. This lesson evaluates a bounded candidate, without implementing deployment purges, distributed replication, or the entire Cache-Control grammar.

Tie independent regressions to ownership decisions

Independently check both decision and selected body for en/en HIT, tr/en MISS, age60 VALIDATE, and personal BYPASS. The latter three must retain a null shared body. Add reject for a public/personal conflict and not-computed for missing evidence; those outcomes differ.

The four actors are logical responsibilities in one process: request facts, stored entry, reuse decision, and delivery selection. Key construction and lookup create no network arrows. Duru receiving a new body in a real Browser belongs to the separate exchange explained in the CDN lesson.

The Node check executes the selected typed function and native URL component observations. Real Browser caches, CDNs, authorization, and learner understanding require their own evidence. An absent regression record does not establish safety for every branch.

NOW APPLY IT TO THE CASE

How do key, freshness, audience and input coverage yield separate decisions?

The public Atlas catalog entry is in en at age 8. An en request yields HIT and tr yields MISS; age 60 requires validation. Personal routes bypass the public profile. Conflicting public-route and personal-audience declarations yield rejection; absent requests remain not-computed.

Which cache owner supplies the case representation? Evaluate key scope, freshness and viewer context together; a hit does not establish the correct viewer.

Open the related case file ↗

READ THE EXAMPLE TOGETHER

Public-cache candidate decision table

Select a field and examine what it supports and where the evidence ends.

Read the raw artifact and field explanations

{
  "profile": {
    "method": "GET",
    "target": "https://books.example/catalog",
    "vary": [
      "accept-language"
    ],
    "publicOnly": true,
    "staleServing": false,
    "headerValues": "fixed tr/en or explicit absence; no general normalization"
  },
  "entry": {
    "method": "GET",
    "target": "https://books.example/catalog",
    "language": "en",
    "audience": "public",
    "body": "Atlas catalog",
    "age": 8,
    "lifetime": 60
  },
  "cases": {
    "normal": {
      "language": "en",
      "class": "public",
      "age": 8,
      "decision": "HIT",
      "reason": "matching-public-fresh",
      "bodySelected": "Atlas catalog",
      "originAction": "none",
      "target": "https://books.example/catalog"
    },
    "variant-miss": {
      "language": "tr",
      "class": "public",
      "age": 8,
      "decision": "MISS",
      "reason": "variant-mismatch",
      "bodySelected": null,
      "originAction": "fetch-required-not-executed",
      "target": "https://books.example/catalog"
    },
    "stale": {
      "language": "en",
      "class": "public",
      "age": 60,
      "decision": "VALIDATE",
      "reason": "matching-stale",
      "bodySelected": null,
      "originAction": "validation-required-not-executed",
      "target": "https://books.example/catalog"
    },
    "personal": {
      "language": "en",
      "class": "personal",
      "age": 8,
      "decision": "BYPASS",
      "reason": "personal-outside-public-profile",
      "bodySelected": null,
      "originAction": "origin-policy-required-not-executed",
      "target": "https://books.example/notes/mine"
    }
  },
  "policyConflict": {
    "routeClass": "public",
    "representationAudience": "personal",
    "decision": "REJECT",
    "bodySelected": null
  },
  "missingEvidence": {
    "request": null,
    "decision": "NOT-COMPUTED",
    "safeSystemClaim": false
  },
  "scope": "Declared conservative public-only profile, not a general HTTP cache or real authorization engine."
}

profile: Scope of the selected public-only decision; not a universal policy for every HTTP cache.
decision / reason: HIT, MISS, VALIDATE, and BYPASS describe different decisions.
bodySelected: Only a matching public fresh HIT selects a body; other outcomes keep null.
originAction: Required next flow; this local model executes no HTTP call.
policyConflict: Inert counterexample rejecting disagreement between trusted declarations.

Inputs are ordinary supplied fixtures. Node executes a selected policy function and native URL parsing; no real HTTP/CDN/Browser cache, parser discrepancy, credential, tenant enforcement, or exploit reproduction occurs.

Two reality checks

A fresh entry suits every user requesting the same URL.

Freshness is one reuse gate; key/variant, audience, and eligibility must also be correct.

Adding a tenant to a key replaces authorization.

Partitioning and resource authorization are separate; a key cannot repair a body produced for the wrong scope.

YOUR TURN

Work through this story.

Predict the outcome, find the evidence boundary, and explain it in your own words.

The public candidate has language=en and the request language=tr. Age is 8 and lifetime 60. Is the English body directly selected?

No. variant-miss yields MISS with bodySelected=null.
Yes. Freshness makes every language variant equivalent.

Read the explained answer

No. variant-miss yields MISS with bodySelected=null. — A fresh entry still fails the accept-language selector. An origin fetch is required but not executed in this artifact.

The route is labelled public, but representationAudience=personal. May the body enter the public cache?

Selected lesson artifact fields; teaching example

policyConflict: {"routeClass":"public","representationAudience":"personal","decision":"REJECT","bodySelected":null}
cases.personal: {"language":"en","class":"personal","age":8,"decision":"BYPASS","reason":"personal-outside-public-profile","bodySelected":null,"originAction":"origin-policy-required-not-executed","target":"https://books.example/notes/mine"}

Yes. A public path label makes all personal fields public.
No. Policy conflict yields REJECT; personal requests BYPASS.

Read the explained answer

No. Policy conflict yields REJECT; personal requests BYPASS. — The public-only profile does not turn a personal representation public because of its route label. No body is selected; the personal path still needs origin policy.

Age=lifetime=60 yields VALIDATE, while a missing request yields NOT-COMPUTED. Why are neither a cache hit nor proof of a safe system?

Read the explained answer

At lifetime equality the entry is not fresh. This profile does not serve stale content; it requires validation and selects no body. Missing evidence contains no request, so no decision can be computed. VALIDATE is not successful real validation, and NOT-COMPUTED is neither an allow nor a deny proof. The table is not a general HTTP cache or real authorization-engine test.

□ I separated stale state from missing evidence.

□ I did not treat required validation as completed validation.

Open the application console · request / response / browser

Also open request, URL, cookie and DOM examples

Sources and scope

MDN — Vary headerDescription: request headers influencing response selection · Directives: wildcard and named headers
RFC 9111 — HTTP Caching4.1 Calculating Cache Keys with the Vary Header Field · 4.2 Freshness · 5.2.2.5 no-store · 5.2.2.7 private · 7.1 Cache Poisoning
MDN — Cache-Control headerResponse directives: private · Response directives: no-store
PortSwigger — Web cache deceptionOverview: classification disagreement and poisoning/deception distinction

YOUR NOTES / THIS BROWSER

Cache keys, Vary, and personalized content

1. Core · Mechanism

Public HIT

Variant MISS

Stale validation

Personal bypass

Which requests does a cache key consider equivalent?

Vary requests matching of named request headers

Matching, fresh, and public are separate gates

Personalized and tenant-scoped content

Why distinguish poisoning from deception?

A decision record should retain its boundaries

2. Red · Trust & Impact

Variant mismatch

Audience conflict

Review equal-URL results through separate decisions

Are classification and representation consistent?

3. Blue · Secure development & defense

Decision matrix

Missing request

Define an approved reuse profile

Tie independent regressions to ownership decisions

How do key, freshness, audience and input coverage yield separate decisions?

Two reality checks

The public candidate has language=en and the request language=tr. Age is 8 and lifetime 60. Is the English body directly selected?

The route is labelled public, but representationAudience=personal. May the body enter the public cache?

Age=lifetime=60 yields VALIDATE, while a missing request yields NOT-COMPUTED. Why are neither a cache hit nor proof of a safe system?

Sources and scope