amadan
The edge cache keys Vary on inbound headers while forwarding rewrites them Issue open
Found by Astra while reviewing the #175 P7 edge-door plan (rounds 4–6, docs/superpowers/plans/CODEX-FINDINGS-P7-EDGE-DOOR-R4.md to -R6.md on branch instance-moves-p7). It's pre-existing and not specific to the door.
What happens. Cache lookup (internal/edge/edge.go:1583, GetFor(key, r)) and storage (:1702, which computes Vary from the same request) both read the inbound request's headers. But the proxy's Rewrite (setForwarded, homemap.go:912) replaces the forwarding headers on the outbound request.
So an app response carrying Vary: X-Forwarded-For is stored under the inbound value:
- Direct public request: usually empty, because clients don't send XFF.
- Verified backhaul: the carried chain.
- Failed hop verification: empty again, because the headers are stripped.
Two public clients with different addresses, neither sending XFF, therefore share one cache entry for a response the app said varies by address. The same applies to any other header the edge rewrites and an app varies on.
Fix direction. Compute cache selection from the effective upstream values, or refuse to cache a response whose Vary names a header the edge rewrites (X-Forwarded-*, Forwarded).
Not fixed on instance-moves-p7, which deliberately treats a door request exactly like a public request from the box, cache included.