All 15 Caching (In-Memory, Distributed & Redis) questions
More in Caching (In-Memory, Distributed & Redis)
What are common cache invalidation strategies, and why is cache invalidation considered a genuinely hard problem? What is response caching middleware in ASP.NET Core, and how does it differ from application-level data caching? What is cache-aside (lazy loading) pattern, and how does it compare to write-through caching? What HTTP caching headers (Cache-Control, ETag) can a client and CDN use, and how do they relate to server-side caching strategies? What is IDistributedCache, and how does it differ from IMemoryCache in a multi-instance deployment? What is the 'cache stampede' (thundering herd) problem, and how can you mitigate it? How does HybridCache (introduced in .NET 9) combine in-memory and distributed caching to solve common pain points? How does Redis's data structure support (beyond simple key-value) enable caching patterns not possible with IMemoryCache? How would you implement cache tag-based invalidation to clear a group of related cache entries at once? How do you handle cache serialization for complex objects when using IDistributedCache, given it only natively supports byte[]?
Advertisement
.NET › Caching (In-Memory, Distributed & Redis)

What are the risks of caching sensitive or user-specific data, and how do you avoid cache poisoning across users?

Intermediate

Answer

Caching sensitive data (like another user's personal information) under a shared or predictable cache key risks accidentally serving one user's private data to another -- a critical security bug -- so cache keys for user-specific data must always incorporate the user's identity (or session) to prevent cross-user leakage, and truly sensitive data (passwords, tokens) generally shouldn't be cached at all, or only in short-lived, tightly-scoped caches.
// DANGEROUS: shared key regardless of user
var cacheKey = "user-profile";  // BUG: same key for every user!

// CORRECT: key includes user identity
var cacheKey = $"user-profile-{userId}";
Real-world example A critical security incident occurs when a response-caching misconfiguration caches a personalized dashboard response without varying by user, causing one user's private financial data to be served to the next user who happened to hit the same cached response.

Common follow-ups: How does VaryByHeader help prevent this specific class of bug in response caching?;What data should never be cached regardless of key scoping?

Authentication & Authorization (Identity JWT OAuth);ASP.NET Core Middleware & Request Pipeline
All 15 Caching (In-Memory, Distributed & Redis) questions