Rules Hub
Code Ruleset
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Never mark user-specific responses as publicly cacheable
Do not set Cache-Control: public on responses that vary by user; a shared cache (CDN/proxy) will serve one user's data to everyone unless the response varies by a user-specific key.
Bad example
| 1 | // Per-user endpoint marked public — CDN/varnish caches it once and serves it to all users |
| 2 | @Header('Cache-Control', 'max-age=10, public') |
| 3 | getMyWatchlist(@ReqUser() user) { /* ... */ } |
Explanation (EN)
A shared cache keyed only by URL can return one user's representation to another.
Objašnjenje (HR)
Good example
| 1 | res.setHeader('Cache-Control', 'private, no-store'); |
| 2 | return res.json(personalData); |
Explanation (EN)
The personalized response is not stored; a less sensitive representation may permit bounded private browser caching.
Objašnjenje (HR)
Notes (EN)
For a personalized response, use private caching or no-store according to sensitivity unless a deliberately designed shared cache enforces the complete authenticated identity partition.
Exceptions / Tradeoffs (EN)
A client-supplied user-ID header or Vary alone does not authorize access. Verify CDN key behavior and trusted identity derivation; do not rely on a generic public policy for confidential responses.