Keeping the cache honest

Key on what matters

Cache poisoning is a mismatch between what shapes the response and what shapes the key:

Tip: Include every input that changes the response in the cache key (or declare them with Vary), and strip or ignore headers like X-Forwarded-Host unless you truly need them. Don't reflect unkeyed input into responses at all, mark genuinely personalised or sensitive responses Cache-Control: no-store, and normalise requests before they reach the cache.