AIKIDO-2026-195704

TL;DR

Faraday::HttpCache's shared cache mode stores and reuses responses to requests that carry an Authorization header without checking whether the response allows shared reuse. A response cached for one user's authenticated request can then be served back to a different user making the same request through the same shared cache, exposing the session specific body and headers the origin returned for the original caller. The fix only stores or reuses such responses when Cache-Control explicitly marks them public, must-revalidate, or sets s-maxage.