Avoiding security incidents due to request collapsing

This report explains how web caching misconfigurations—especially Amazon CloudFront's request collapsing (request coalescing)—can unintentionally serve one user's sensitive API response to other users, causing data leakage. The author reviews multiple incidents (14 tracked, 11 in the last 4 years), shows how request collapsing can ignore Cache-Control directives, and recommends mitigations (use the managed CachingDisabled policy or set minimum TTL to 0 combined with origin Cache-Control headers) plus simultaneous-request testing to detect issues.