Two signed-in users request the same account URL. The address is identical, but the response should not be. A cache that treats the URL as the whole identity of the response can create a serious privacy problem.
Classify the response before caching it
Separate public content from content that depends on a user, organisation, permission or other private context. Decide whether the response should be cached at all, and at which layer. Browser, CDN, reverse-proxy and application caches do not automatically share the same rules.
MDN’s Cache-Control reference distinguishes directives such as private and no-store. Private caching permits storage in a private cache while preventing shared-cache storage; it is not the same as prohibiting storage. Use the appropriate policy for the information and verify that each relevant layer honours it.
Do not let a cache hit replace permission checks
An application-level cache key may need to include the authorised context and relevant variations. That still does not remove the need to verify access to the requested resource. A well-formed key is one part of the design, not a substitute for authentication and authorisation.
Consider permission changes and logout behaviour too. A response that was appropriate yesterday may no longer be appropriate after access is revoked. Define invalidation and retention rather than leaving them as an accidental consequence of a default expiry.
Test with deliberately different accounts
Use an authorised test environment with two synthetic users whose records are visibly different. Warm the cache as one, then request the same route as the other and while signed out. Check bodies, headers and download responses. Never use real customers’ private information as test fixtures.
Repeat after a role change and a cache refresh. Record which layer served the response so a passing browser test does not hide a different CDN configuration. A performance improvement is ready only when it preserves the access boundaries the uncached application was required to enforce.