ASP.NET Core Caching — Why ResponseCache Leaks User Data

using Microsoft.Extensions.Caching.Memory;
using System;
using System.Threading.Tasks;

// Register IMemoryCache in Program.cs:
// builder.Services.AddMemoryCache();

public class ProductService
{
    private readonly IMemoryCache _cache;
    private readonly IProductRepository _repository;

    // Cache key constants prevent typos across the codebase
    private const string ProductCacheKeyPrefix = "product_";
    private static readonly TimeSpan ProductCacheDuration = TimeSpan.FromMinutes(10);

    public ProductService(IMemoryCache cache, IProductRepository repository)
    {
        _cache = cache;
        _repository = repository;
    }

    public async Task<Product?> GetProductByIdAsync(int productId)
    {
        // Build a unique key per product so we can invalidate one without flushing all
        string cacheKey = $"{ProductCacheKeyPrefix}{productId}";

        // TryGetValue returns true on a cache HIT — we skip the database entirely
        if (_cache.TryGetValue(cacheKey, out Product? cachedProduct))
        {
            Console.WriteLine($"[CACHE HIT] Returning product {productId} from memory cache.");
            return cachedProduct;
        }

        // Cache MISS — go to the real data source
        Console.WriteLine($"[CACHE MISS] Fetching product {productId} from database.");
        Product? product = await _repository.GetByIdAsync(productId);

        if (product is not null)
        {
            // Configure cache entry options before storing
            var cacheOptions = new MemoryCacheEntryOptions()
                // Evict this entry if it hasn't been accessed in 5 minutes (sliding)
                .SetSlidingExpiration(TimeSpan.FromMinutes(5))
                // But always evict after 10 minutes regardless of access (absolute)
                .SetAbsoluteExpiration(ProductCacheDuration)
                // Mark as normal priority — the runtime can evict under memory pressure
                .SetPriority(CacheItemPriority.Normal);

            _cache.Set(cacheKey, product, cacheOptions);
            Console.WriteLine($"[CACHE SET] Product {productId} stored in memory cache.");
        }

        return product;
    }

    // Call this when a product is updated so the next read fetches fresh data
    public void InvalidateProductCache(int productId)
    {
        string cacheKey = $"{ProductCacheKeyPrefix}{productId}";
        _cache.Remove(cacheKey);
        Console.WriteLine($"[CACHE INVALIDATED] Removed product {productId} from cache.");
    }
}

// --- Simulated output for two sequential calls to GetProductByIdAsync(42) ---
// First call:
// [CACHE MISS] Fetching product 42 from database.
// [CACHE SET]  Product 42 stored in memory cache.
//
// Second call (within 5 minutes):
// [CACHE HIT]  Returning product 42 from memory cache.

// Program.cs registration (Redis example):
// builder.Services.AddStackExchangeRedisCache(options =>
// {
//     options.Configuration = builder.Configuration.GetConnectionString("Redis");
//     options.InstanceName = "MyApp:"; // Prefix all keys to avoid collisions
// });
//
// For SQL Server instead, use:
// builder.Services.AddDistributedSqlServerCache(options => { ... });

using Microsoft.Extensions.Caching.Distributed;
using System.Text.Json;
using System.Threading;
using System.Threading.Tasks;

// A generic wrapper that hides the byte-array pain of IDistributedCache
public class DistributedCacheService
{
    private readonly IDistributedCache _distributedCache;

    public DistributedCacheService(IDistributedCache distributedCache)
    {
        _distributedCache = distributedCache;
    }

    // Returns cached value or null on a miss — caller decides what to do
    public async Task<T?> GetAsync<T>(string cacheKey, CancellationToken cancellationToken = default)
        where T : class
    {
        byte[]? cachedBytes = await _distributedCache.GetAsync(cacheKey, cancellationToken);

        if (cachedBytes is null || cachedBytes.Length == 0)
        {
            return null; // Cache miss
        }

        // Deserialise from JSON bytes back to the strongly-typed object
        return JsonSerializer.Deserialize<T>(cachedBytes);
    }

    public async Task SetAsync<T>(
        string cacheKey,
        T value,
        TimeSpan absoluteExpiration,
        CancellationToken cancellationToken = default)
        where T : class
    {
        byte[] serialisedBytes = JsonSerializer.SerializeToUtf8Bytes(value);

        var cacheEntryOptions = new DistributedCacheEntryOptions
        {
            // Absolute expiration from now — always evict after this window
            AbsoluteExpirationRelativeToNow = absoluteExpiration
        };

        await _distributedCache.SetAsync(cacheKey, serialisedBytes, cacheEntryOptions, cancellationToken);
    }

    public async Task RemoveAsync(string cacheKey, CancellationToken cancellationToken = default)
    {
        await _distributedCache.RemoveAsync(cacheKey, cancellationToken);
    }
}

// --- Usage in a controller or service ---
public class OrderSummaryService
{
    private readonly DistributedCacheService _cache;
    private readonly IOrderRepository _orderRepository;
    private static readonly TimeSpan OrderSummaryCacheDuration = TimeSpan.FromMinutes(15);

    public OrderSummaryService(DistributedCacheService cache, IOrderRepository orderRepository)
    {
        _cache = cache;
        _orderRepository = orderRepository;
    }

    public async Task<OrderSummary?> GetOrderSummaryAsync(int customerId, CancellationToken cancellationToken)
    {
        string cacheKey = $"order_summary_{customerId}";

        // Step 1: Try the distributed cache first
        OrderSummary? cached = await _cache.GetAsync<OrderSummary>(cacheKey, cancellationToken);
        if (cached is not null)
        {
            Console.WriteLine($"[REDIS HIT] Order summary for customer {customerId} served from Redis.");
            return cached;
        }

        // Step 2: Cache miss — hit the database
        Console.WriteLine($"[REDIS MISS] Querying database for customer {customerId} order summary.");
        OrderSummary? summary = await _orderRepository.GetSummaryByCustomerIdAsync(customerId, cancellationToken);

        // Step 3: Store in Redis for the next caller — all server instances benefit
        if (summary is not null)
        {
            await _cache.SetAsync(cacheKey, summary, OrderSummaryCacheDuration, cancellationToken);
            Console.WriteLine($"[REDIS SET] Customer {customerId} summary cached for 15 minutes.");
        }

        return summary;
    }
}

// Program.cs — register and use the middleware (ORDER MATTERS):
// builder.Services.AddResponseCaching();
// ...
// app.UseResponseCaching(); // Must come before app.MapControllers()

using Microsoft.AspNetCore.Mvc;
using System.Collections.Generic;
using System.Threading.Tasks;

[ApiController]
[Route("api/[controller]")]
public class CatalogueController : ControllerBase
{
    private readonly ICatalogueService _catalogueService;

    public CatalogueController(ICatalogueService catalogueService)
    {
        _catalogueService = catalogueService;
    }

    // This response is cached for 60 seconds server-side AND tells CDNs they can cache it too.
    // 'public' means any cache (server, CDN, proxy) can store this response.
    // 'VaryByQueryKeys' means separate cache entries are kept per 'category' query param
    // so /api/catalogue?category=shoes and ?category=hats each get their own cached version.
    [HttpGet]
    [ResponseCache(Duration = 60, Location = ResponseCacheLocation.Any, VaryByQueryKeys = new[] { "category" })]
    public async Task<IActionResult> GetProductsAsync([FromQuery] string category = "all")
    {
        Console.WriteLine($"[CONTROLLER HIT] Fetching products for category: {category}");
        // This line only runs on a cache MISS — during a 60-second window it runs once per category
        IEnumerable<ProductSummary> products = await _catalogueService.GetByCategoryAsync(category);
        return Ok(products);
    }

    // [ResponseCache(NoStore = true)] explicitly opts this endpoint OUT of caching.
    // Use this for any endpoint that returns user-specific or sensitive data.
    [HttpGet("my-orders")]
    [ResponseCache(NoStore = true, Location = ResponseCacheLocation.None)]
    public async Task<IActionResult> GetMyOrdersAsync()
    {
        // Each call always hits the controller — never cached
        var orders = await _catalogueService.GetOrdersForCurrentUserAsync();
        return Ok(orders);
    }
}

// HTTP Response headers produced by the first endpoint:
// Cache-Control: public,max-age=60
// Vary: Accept-Encoding
//
// Subsequent requests within 60 seconds return:
// [Served from response cache — controller action does NOT execute]
//
// HTTP Response headers produced by the second endpoint:
// Cache-Control: no-store,no-cache

using StackExchange.Redis;
using Microsoft.Extensions.Caching.Distributed;
using System.Text.Json;

public class CacheInvalidationService
{
    private readonly IDistributedCache _cache;
    private readonly IConnectionMultiplexer _redis;

    public CacheInvalidationService(IDistributedCache cache, IConnectionMultiplexer redis)
    {
        _cache = cache;
        _redis = redis;
    }

    // Invalidate a single key
    public async Task InvalidateKeyAsync(string cacheKey)
    {
        await _cache.RemoveAsync(cacheKey);
        // Notify other servers to evict their local L1 cache
        var subscriber = _redis.GetSubscriber();
        await subscriber.PublishAsync("cache:invalidation", cacheKey);
    }

    // Invalidate all keys belonging to a tag (requires a Redis Set of keys per tag)
    public async Task InvalidateTagAsync(string tag)
    {
        var db = _redis.GetDatabase();
        // Get all keys that belong to this tag (e.g., "tag:category:shoes")
        string tagKey = $"tag:{tag}";
        RedisValue[] memberKeys = await db.SetMembersAsync(tagKey);

        // Remove each key from the distributed cache
        var tasks = memberKeys.Select(k => _cache.RemoveAsync(k.ToString()));
        await Task.WhenAll(tasks);

        // Publish for L1 eviction on other servers
        var subscriber = _redis.GetSubscriber();
        await subscriber.PublishAsync("cache:invalidation:tag", tag);

        // Remove the tag set itself
        await db.KeyDeleteAsync(tagKey);
    }

    // Associate a cache key with a tag during Set
    public async Task SetWithTagAsync<T>(string cacheKey, T value, TimeSpan expiration, string tag)
    {
        // Store in distributed cache as usual
        byte[] bytes = JsonSerializer.SerializeToUtf8Bytes(value);
        await _cache.SetAsync(cacheKey, bytes, new DistributedCacheEntryOptions
        {
            AbsoluteExpirationRelativeToNow = expiration
        });

        // Add the key to the tag's Redis Set
        var db = _redis.GetDatabase();
        await db.SetAddAsync($"tag:{tag}", cacheKey);
    }
}

// Usage:
// await invalidationService.SetWithTagAsync("product:42", product, TimeSpan.FromMinutes(10), "category:shoes");
// ... later, when the shoes category changes:
// await invalidationService.InvalidateTagAsync("category:shocks"); // invalidates all related keys

using Microsoft.Extensions.Caching.Memory;
using Microsoft.Extensions.Caching.Distributed;
using System.Text.Json;

public class TwoLevelCacheService
{
    private readonly IMemoryCache _localCache;    // L1
    private readonly IDistributedCache _distCache; // L2

    public TwoLevelCacheService(IMemoryCache localCache, IDistributedCache distCache)
    {
        _localCache = localCache;
        _distCache = distCache;
    }

    public async Task<T?> GetAsync<T>(string cacheKey, Func<Task<T?>> fetchFromDb, CancellationToken ct = default)
        where T : class
    {
        // Try L1 (local memory) first
        if (_localCache.TryGetValue(cacheKey, out T? localResult) && localResult is not null)
        {
            return localResult;
        }

        // L1 miss — try L2 (distributed, e.g., Redis)
        byte[]? distBytes = await _distCache.GetAsync(cacheKey, ct);
        if (distBytes is not null && distBytes.Length > 0)
        {
            T? deserialized = JsonSerializer.Deserialize<T>(distBytes);
            if (deserialized is not null)
            {
                // Populate L1 for future near-instant access
                _localCache.Set(cacheKey, deserialized, TimeSpan.FromMinutes(5)); // sliding for L1
                return deserialized;
            }
        }

        // L2 miss — fetch from database
        T? result = await fetchFromDb();
        if (result is null) return null;

        // Store in both caches
        byte[] bytes = JsonSerializer.SerializeToUtf8Bytes(result);
        var distOptions = new DistributedCacheEntryOptions
        {
            AbsoluteExpirationRelativeToNow = TimeSpan.FromMinutes(30)
        };
        await _distCache.SetAsync(cacheKey, bytes, distOptions, ct);

        _localCache.Set(cacheKey, result, TimeSpan.FromMinutes(5));

        return result;
    }

    // Invalidate from both caches and broadcast to other servers
    public async Task InvalidateAsync(string cacheKey, IConnectionMultiplexer redis, CancellationToken ct = default)
    {
        _localCache.Remove(cacheKey);
        await _distCache.RemoveAsync(cacheKey, ct);

        var subscriber = redis.GetSubscriber();
        await subscriber.PublishAsync("cache:l1:evict", cacheKey);
    }
}

// --- Usage ---
// var product = await twoLevelCache.GetAsync("product:42",
//     () => _repo.GetByIdAsync(42), cancellationToken);

// io.thecodeforge — csharp tutorial

using Microsoft.Extensions.Caching.Memory;

public class PricingService
{
    private readonly IMemoryCache _cache;
    private readonly IProductRepository _repository;

    public PricingService(IMemoryCache cache, IProductRepository repository)
    {
        _cache = cache;
        _repository = repository;
    }

    public async Task<decimal> GetPriceAsync(int productId)
    {
        string key = $"price:{productId}";
        
        // GetOrCreate synchronizes access using a semaphore internally
        return await _cache.GetOrCreateAsync(key, async entry =>
        {
            entry.AbsoluteExpirationRelativeToNow = TimeSpan.FromMinutes(5);
            entry.SlidingExpiration = TimeSpan.FromMinutes(2);
            return await _repository.FetchProductPriceAsync(productId);
        });
    }
}

// io.thecodeforge — csharp tutorial

using Microsoft.Extensions.Caching.Hybrid;

// Register in Program.cs
builder.Services.AddHybridCache(options =>
{
    options.DefaultEntryOptions = new HybridCacheEntryOptions
    {
        Expiration = TimeSpan.FromMinutes(5),
        LocalCacheExpiration = TimeSpan.FromSeconds(30)
    };
});

// In service layer
public async Task<Product> GetProductAsync(int id)
{
    var cacheKey = $"product:{id}";
    return await _cache.GetOrCreateAsync<Product>(
        cacheKey,
        async cancel => await _db.Products.FindAsync(new object[] { id }, cancel),
        cancellationToken: CancellationToken.None
    );
}

// io.thecodeforge — csharp tutorial

// Quick mental model for cache selection
public enum CacheChoice
{
    InMemory,    // Single server, fast, volatile
    Distributed, // Multi-server, consistent, slower
    Response,    // HTTP level, static content, auth trap
    TwoLevel,    // Fast + consistent, stampede risk
    HybridCache  // .NET 9: stampede-safe L1/L2 wrapper
}

// Real-world heuristic
if (servers == 1 && data.IsReference)
    UseInMemory();
else if (servers > 1 && data.IsUserSession)
    UseDistributed();
else if (data.IsStatic || data.IsPublic)
    UseResponseCaching();
else if (dotNET9Available)
    UseHybridCache();

// io.thecodeforge — csharp tutorial

// Safe serialization for distributed cache across .NET versions
var options = new JsonSerializerOptions
{
    PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
    // .NET 8 removed BinaryFormatter — use JSON or MessagePack
};

var data = new CachePayload { UserId = 42, Role = "Viewer" };
var json = JsonSerializer.SerializeToUtf8Bytes(data, options);

// Store in Redis — works on .NET 6, 7, 8, 9
await cache.SetAsync("user:42", json);

// Retrieve — no breaking changes across minor versions
var cached = await cache.GetAsync("user:42");
var result = JsonSerializer.Deserialize<CachePayload>(cached, options);

Console.WriteLine(result.Role); // Output: Viewer