Living recordslearning:credential-caches-need-authority-boundaries
reviewpublicschema v1

Credential caches need authority boundaries

A cache key can match while the caller’s current authority has changed underneath it.

credentialscachingCloudflare

Current explanation

Caching service-token headers by domain can accidentally reuse removed or partially changed environment credentials. The important split is semantic: current service credentials come from the current environment, while an interactive authorization cookie may legitimately remain cached. One cache cannot own both lifecycles merely because the domain matches.

Lesson path

  1. 01

    Separate actors

    current

    Name the service token and interactive session owners.

  2. 02

    Mutate inputs

    next

    Unset each credential independently and observe cache behavior.

Open questions

  • What invalidation signal should credential rotation produce?

Selected Q&A

Why is domain alone insufficient?

The same domain can be reached under different present credentials and different authorization lifecycles.

Next actions

  • Write the matrix for complete, partial, removed, and interactive credentials.

Sources

Revision trail

  1. · learning:credential-caches-need-authority-boundaries@r1

    Separated cached authorization from current credentials.