Edge caching strategy handles personalized content

CWE-525 (Information Exposure Through Browser Caching) is the formal classification, but the concrete failure is simpler: if a user-specific API response is cached at the CDN edge without Cache-Control: private, the next user who hits the same edge node may receive another user's private data. This is a data-exposure bug masquerading as a caching misconfiguration. ISO 25010:2011 time-behaviour flags the caching intent; the security consequence is personally identifiable or account-sensitive data served cross-user from an edge cache.

Every API route that returns user-specific data must set Cache-Control: private, no-cache. Verify this is applied at the route level, not overridden by a global CDN header rule.

// app/api/user/profile/route.ts
export async function GET(request: Request) {
  const profile = await getUserProfile(request)
  return Response.json(profile, {
    headers: { 'Cache-Control': 'private, no-cache' },
  })
}