Prevent Cross-Tenant CDN Cache Leaks
Classify authenticated responses before an edge cache can store them.
An edge cache sits before the application that knows the caller's role. If an authenticated response is cached under a shared URL, the next request may receive it without running authorization. This is different from an application cache-key problem: the CDN may never see the application's tenant or session state. Treat the cache policy as part of the access boundary.
Classify each response
List route families, not just one example URL. For each, decide whether the body is public, tenant-specific, user-specific, or secret-bearing. Then record the cache rule and an observable test.
| Response class | Default treatment | Test |
|---|---|---|
| Public static asset | Shared caching can be allowed | Same bytes for all callers |
| Public page with private fragment | Split private fetch from cached shell | No private bytes in HTML |
| Tenant dashboard | Do not use a shared cache without a proven variant key | A and B markers never cross |
| Account or export page | Private or no-store as needed | Edge never serves another user |
| Signed download | Evaluate link capability and expiry separately | Expired link fails at edge and origin |
Inspect response headers from the deployed edge path, not only the origin. Verify that cookies, authorization headers, URL parameters, and vary rules have the intended effect. A private cache directive can still leave earlier cached objects until purged, so include migration behavior when changing policy.
Use synthetic A and B sessions in a controlled environment. Warm a route as A, request it as B, then repeat in reverse order. Check edge hit/miss metadata and response body markers. Include logged-out requests and stale-while-revalidate behavior if used. A successful origin authorization test does not cover this path.
Check old edge objects
Deploy the new rule after warming an old edge object with synthetic data. Purge or version the object, then confirm the edge no longer serves the stale private response.
The OWASP ASVS provides a verification frame for web services, while OWASP multi-tenant guidance makes the isolation goal explicit. This response-class policy is the artifact. It should be reviewed whenever a new CDN rule or framework cache feature is added. Do not test third-party edges without written scope.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.