Challenge 2: Two Users Seeing Each Other's Order History — Solution Walkthrough

Why this happens:

The default cache key is a combination of scheme, backend host, and
request URI — it says nothing about which user is making the request.
If every logged-in user's "My Orders" page is reached via the exact
same URL (e.g. /account/orders), the default cache key is identical
for every single user who requests that page, regardless of who they
actually are. The first user to request that URL gets their own order
history cached under that shared key; every subsequent user requesting
the same URL is then served that exact same cached response — someone
else's order history — because, per this chapter's own material, the
cache key never varied by user identity in the first place.

The fix:

  proxy_cache_key "$scheme$proxy_host$request_uri$cookie_session_id";

Adding the user's own session cookie value into the cache key means
each distinct user now produces a genuinely different cache key for
the identical URL, so their own cached "My Orders" response is only
ever served back to them — no other user's session cookie can produce
the same key.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise applies this chapter's own cache-key mechanism directly
to the exact category of bug Web Servers Fundamentals only described
abstractly, correctly identifying the missing identity component in
the cache key as the root cause, and writing the specific fix rather
than a vague "add more security."