A web cache (CDN, reverse proxy, or the framework's own) sits in front of the origin and keeps copies of responses.

The cache key

The cache decides whether two requests are "the same" by hashing a subset of the request — typically the path, and sometimes the query string and a few headers. Cookies are almost never in the key. So two requests to /my-account/x.js — one with your cookie, one with the victim's — are "the same" to the cache.

The cache rules

Separately, the cache decides whether a response is storable. Common rules, roughly in priority order:

1. Static file extension in the path (.js, .css, .png, .woff) -> cache, often ignoring Cache-Control.
2. Specific path prefixes (/static/, /assets/).
3. The origin's Cache-Control / Expires headers.

The mismatch

WCD needs a URL where:

• the cache applies a "storable" rule (usually: it ends in .js), and
• the origin still returns the sensitive dynamic page (because it ignores the bit after some delimiter, or normalises the path differently).

Find both halves and you can put a victim's /my-account response into a cache entry that you can then read.