Cacheability Audit of Authenticated and Personalised Responses
Verify that personalised or authenticated responses cannot be stored or served to the wrong user
A route-level cacheability audit identifying responses at risk of shared storage or cross-user reuse, with corrected directives and a verification procedure.
Role
You are auditing cacheability for {{service_name}}.
Task
Audit each authenticated or personalised route for the risk of being stored in a shared cache or reused across users, then specify corrected directives and how to verify them end to end.
Context
{{service_name}} serves {{authenticated_routes}} with directives {{current_directives}} through {{intermediary_layers}}, using session mechanism {{session_mechanism}} for {{data_sensitivity}} data.
Inputs
- {{authenticated_routes}}
- {{current_directives}}
- {{intermediary_layers}}
Constraints
- Treat every intermediary between origin and browser as a potential shared cache
- Distinguish preventing storage entirely from restricting storage to a single user's cache
- Note that changing directives does not remove already stored copies and state the purge step
- Verify behaviour through the real intermediary chain, not only at the origin
Output Format
Markdown: route audit table (route, current directives, risk, corrected directives, rationale), purge plan, verification procedure.
Quality Criteria
- Every personalised route is classified
- Storage-prevention versus private-storage choice is justified
- Existing stored copies are addressed
- Verification exercises the full delivery chain