Session state leakage

A path-only cache bypass lets Cloudflare serve one shopper's cart header to another

Cloudflare caches by file extension and leaves HTML alone by default, so the exposure starts with the rule someone writes to lift the hit ratio. A dev.to write-up argues that rule has to match session cookies as well as paths.