What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 127 Stack Exchange communities.

Please be patient with me, as I'm not too knowledgeable on this topic. This question has been prompted by Hijacked session: Signed in as someone else.

When I access my user page on Stackoverflow, the first request is a GET request and the response has the cache header Cache-Control: public, max-age=120. The response for this request is a web-page that contains private information about me such as e-mail address, and additionally prompts additional requests, some marked private and some public.

Doesn't this public mean that this page is permissible for general, not per-user caching? Isn't it problematic when this page contains stuff like my e-mail address?

I mean, wouldn't all pages on any stackexchange site to be marked as private if the user is logged-in, since by definition this page will be localized to that user?

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

Doesn't this public mean that this page is permissible for general, not per-user caching? Isn't it problematic when this page contains stuff like my e-mail address?

Well, yes. But that's irrelevant, because the response also contains a Vary: * header:

A Vary field value of "*" implies that a cache cannot determine from the request headers of a subsequent request whether this response is the appropriate representation.

This basically means that the caching entity has to ask the server to revalidate the content before serving up the page, and the server won't send a 304 response in cases where it would mean serving up a page you (or rather, someone who isn't you) shouldn't see.

Of course, there's nothing stopping your ISP (or other intermediary) from doing whatever it wants despite that, but in general it should be fine.

share|improve this answer
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .