47 shoppers got the same cart. Every dashboard stayed green.

transcript

Black Friday, 10:47. Customers are seeing strangers' carts. Even partial card digits. And every backend dashboard says perfectly healthy.

David, a backend engineer, checks the database. Every cart belongs to the right user. Auth? Sessions valid. Load balancer? Routing correctly. So he calls the cart API himself. And gets user 456's cart. The header says cache HIT. 47 hits. The CDN served it.

User A asks for their cart. The edge has nothing, so it asks the origin. The edge stores the answer for 300 seconds. Its key? The URL path. Nothing else. User B asks with a different token. Same URL, same key. B gets A's cart. So does the next user. 47 of them. The backend sees nothing.

That's why every dashboard stayed green. Cached answers never reach the backend. The origin was right. The edge was wrong. Nobody watched the edge.

But here's the cruel part. The backend sent the right headers. Private. No cache. But a CDN rule cached everything under slash api. Products. And carts. And on some edges, a flag told the CDN to ignore origin headers.

The backend did its job. The edge undid it. Personal data? Put the user in the cache key. Or don't cache it. Every cache rule is a security boundary.

Full breakdown in the lecture.