How do you cache with Nginx without leaking private responses?

Question

IT Interview Practice · Accepted Answer

Cache only responses that the intended visitors are allowed to share. A public product description and a signed-in customer's account page have different requirements.

## See how a leak can happen

Imagine Alice requests `/account` and Nginx stores her response under that URL. If Bob later receives the same cached response, he sees Alice's data. The problem is that a shared cache was used for a private result.

Start with explicitly public routes. The cache key, which names the stored response, must distinguish relevant variants such as host, path, query and language.

## For a private route, control both directions

Inside a server where a proxy cache is otherwise configured, a dedicated private location can contain:

```nginx
location /account/ {
    proxy_pass http://127.0.0.1:3000;
    proxy_cache_bypass 1;
    proxy_no_cache 1;
}
```

`proxy_cache_bypass` prevents reading a shared cached response. `proxy_no_cache` prevents storing the new response. This example protects the `/account/` prefix; audit other private routes and competing locations as well.

## Check with different users

Try two accounts and an anonymous visitor, checking both content and cache behavior. Respect application `Cache-Control` and `Set-Cookie` handling. If a public product page includes a personalized price, separate that private data or exclude the response from shared caching.

[Official documentation](https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cache_bypass).

See how a leak can happen

For a private route, control both directions

Check with different users

Related questions