The Ravens account page is per-user private, but it is returned with Cache-Control: public, so a shared cache stores it and hands it to the next visitor. If admin opens their account then you fetch the same path, you get their data.
A page with a button to make admin open their account and a button for you to fetch the same path. The account is returned with Cache-Control: public, so the shared cache stores it and serves it to anyone.
Fetch admin private data from the shared cache.
You fetched admin data from the cache.
Why the solution worked
A private page with a public caching header is stored by any intermediary cache and served to another user. The fix is Cache-Control: private and no-store on every response with private or authenticated data.
The root cause
A public caching header on a private response. The root is a wrong caching directive for authenticated content.
How the code is fixed
Use private and no-store for every response with private or authenticated data.
Vulnerable code
res.setHeader('Cache-Control', 'public, max-age=60'); // on a per-user page
Safe code
res.setHeader('Cache-Control', 'private, no-store'); // authenticated, per-user data
Impact in the real world
Publicly caching private pages leaks users data to each other via the shared cache (a CDN or proxy).
How defenders detect it
Defenders enforce no-store on authenticated responses and alert on public caching headers over private content.
