AIKIDO-2026-143550

TL;DR

Thruster's HTTP cache reads only the first Vary response field line and only the first value of each request header the response varies on, even though HTTP allows both to be sent as several field lines. A shared cacheable response partitioned by a Vary: Cookie or Authorization sent on a later field line can be served to a different user whose header value differs, and a client that repeats a varied request header can poison the cache entry that ordinary clients receive. The response compression guard has the same blind spot and can skip disabling compression for a response that varies on a later Vary: Cookie line. The fix uses Cache-Control and Vary from every field line, blocks caching when no-store or private is present even alongside public, and applies s-maxage.