All pages (that I tested) on Stack Overflow have this header:
Cache-Control: public, max-age=60
The problematic part is the
public keyword which should be
private instead. According to RFC 2616, Section 14.9.1:
Indicates that the response MAY be cached by any cache, even if it would normally be non-cacheable or cacheable only within a non- shared cache. (See also Authorization, section 14.8, for additional details.)
Indicates that all or part of the response message is intended for a single user and MUST NOT be cached by a shared cache. This allows an origin server to state that the specified parts of the response are intended for only one user and are not a valid response for requests by other users. A private (non-shared) cache MAY cache the response.
In short the
public keyword is allowing well-behaving proxies to cache the content sent to a logged-in user and display it to other people.
This is most definitely what is causing issues like Co-workers logged in as me when viewing question I asked and others (I've seen at least another similar report, but I can't find it anymore).
EDIT: there was an error in my original post in which I implied that
public was fine for unregistered users. This is not true since the proxy would be instructed to send the unregistered page (no user name, etc) to - possibly - registered users. It should be
private in all cases.