Your Cache Is Part of the Security Model

Automated excerpt

Once cached data participates in an authorization result, it also determines how long an old security fact remains usable. This rarely begins as a security decision. At that point, cache configuration has become access-control policy. An Outage Needs a Cache Policy When the identity source is unavailable, a cache miss is obvious. Test the Old Answer Cache tests often confirm hit rate and eviction.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.