All 15 Caching questions
More in Caching
What HTTP caching headers (Cache-Control, ETag) can a Node.js/Express API use to let clients and CDNs cache responses? How would you implement a Least Recently Used (LRU) cache in Node.js, and why is eviction necessary for an in-memory cache? What is memoization, and how does it differ from a general-purpose external cache like Redis? How would you cache the result of a database query in Node.js while ensuring the cache is properly invalidated when the underlying data changes? What is negative caching, and why might you deliberately cache the fact that a lookup returned 'not found'? What are the main cache invalidation strategies (TTL, write-through, cache-aside), and when is each appropriate? What is cache stampede (thundering herd), and how do you prevent it in a high-traffic Node.js service? What is Redis's EXPIRE and how do TTL-based keys interact with Redis's own memory eviction policies under memory pressure? What is the 'stale-while-revalidate' caching strategy, and how would you implement it for an API response? What is multi-tier caching (combining an in-memory L1 cache with a distributed L2 cache), and what problem does it solve?
Advertisement
Back to results for “Caching”
Node.js › Caching

What is the risk of caching sensitive or user-specific data with a shared cache key, and how do you avoid it?

Intermediate

Answer

If a cache key doesn't incorporate the identity of the requesting user (or tenant, or permission context), one user's request could be served another user's cached, personalized data -- a serious privacy bug. The fix is ensuring cache keys always include every dimension the response varies by (user ID, locale, permission level), the same principle behind the HTTP 'Vary' header.
// Bug: cache key doesn't include the user
const cacheKey = 'dashboard-data';

// Fixed: cache key scoped to the specific user
const cacheKey = `dashboard-data:${userId}`;
Real-world example A security audit discovers a dashboard-caching layer used a single shared cache key regardless of the logged-in user, meaning the first user to load the dashboard after expiration had their personalized data served to every subsequent user until the entry expired.

Common follow-ups: What other dimensions besides user ID commonly need to be included in a cache key (locale, currency, permission role)?;How does the HTTP 'Vary' header address this same class of problem for CDN and browser caching?

Security;HTTP & HTTPS Modules
All 15 Caching questions