A retailer's CloudFront distribution is serving one shopper's cart JSON to a different shopper. The behavior caches the API path, and the cache policy does not include the session cookie. Cart responses must not be stored at the edge. What should change?
Select an answer to reveal the explanation.
Short Explanation
The edge saved a private note and handed it to the next person in line. You cached a cart response and left the session cookie out of the decision, so shoppers share one object. Stop caching that path, because putting the cookie in the key still stores private carts at the edge.
Full Explanation
CloudFront serves a cached object when the request matches the cache key. This behavior caches the cart path, and the cache policy does not vary on the session cookie, so the first shopper's JSON is a hit for everyone else. The requirement is that cart responses are not stored at the edge, so the behavior should use a caching-disabled policy, or no cache, for that path and forward the request to the origin. Adding the cookie to the cache key would separate shoppers, but it still stores personalized responses in the cache, which violates the requirement and multiplies cache entries. The origin's idle timeout closes quiet connections. It does not decide whether CloudFront stores a response. An Application Load Balancer does not gain a CloudFront cache because a distribution sits in front of it. Caveat: a path that mixes public images and private JSON needs two behaviors, or the public objects lose their cache too. Operational check: after the change, request the cart twice with different session cookies and confirm both responses are misses that match only their own shopper.