Re: no-vary: security - cache poisoning

I don't recall anyone proposing to use Cache-Control, and it seemed more
similar to Vary than Cache-Control directives like max-age, in that it
affects keying (i.e., how broadly the resource to be cached is defined)
rather than lifetime & freshness.

I don't recall considering it at the time, but likely relevant, is a
concern that some sites may allow pages to set Cache-Control but not other
headers, without considering the possibility of cache pollution of other
URLs (esp. on pages with index.php?page= type URLs).

On Mon, Jan 19, 2026 at 1:45 AM Julian Reschke <julian.reschke@gmx.de>
wrote:

> Am 19.01.2026 um 07:24 schrieb David Benjamin:
> > ...
> > The draft *does* use a separate header. It is *not* a Cache-Control
> > option. I mentioned it because another thread suggested it.
> > ...
>
> Actually, the proposal is to explain *why* this isn't using
> Cache-Control. If this is one of the reasons, we should definitvely add
> this to the list of reasons.
>
> Best regards, Julian
>
>