Cache respects TTL/expiration rules

A cache with no TTL enforcement retains data beyond its useful life — including sensitive content like user-specific feeds, prices, or session artifacts. CWE-922 (Insecure Storage of Sensitive Information) applies when cached data persists longer than the context that authorized it: a logged-out user's next session can read the previous user's cached content if the cache is never expired. ISO 25010:2011 reliability.recoverability is also impacted — stale data served from an indefinite cache is indistinguishable from fresh data, making correctness impossible to guarantee after server-side updates.

Implement TTL checking on every cache read and a cleanup timer that evicts expired entries periodically. Cap TTLs at 86,400 seconds (24 hours) for any cached data.

interface Entry<T> { data: T; storedAt: number; ttl: number; }

export class CacheManager<T> {
  private store = new Map<string, Entry<T>>();

  constructor(private defaultTTL = 5 * 60_000) {
    setInterval(() => this.sweep(), 60_000);
  }

  set(key: string, data: T, ttl = this.defaultTTL) {
    this.store.set(key, { data, storedAt: Date.now(), ttl });
  }

  get(key: string): T | undefined {
    const e = this.store.get(key);
    if (!e) return undefined;
    if (Date.now() - e.storedAt > e.ttl) { this.store.delete(key); return undefined; }
    return e.data;
  }

  private sweep() {
    const now = Date.now();
    for (const [k, e] of this.store) {
      if (now - e.storedAt > e.ttl) this.store.delete(k);
    }
  }
}

Always call cache.invalidate(key) immediately after a mutation rather than waiting for TTL expiry. On logout, call cache.clear() to prevent the next session from reading the previous user's data.