OutputCache and Authorize filters in MVC3

Question

I am reading a book about MVC2, and in the OutputCache section it states:

Warning In the earlier section “How Authorization Filters Interact with Output Caching,” I explained that [Authorize] has special behavior to ensure that unauthorized visitors can’t obtain sensitive information just because it’s already cached. However, unless you specifically prevent it, it’s still possible that cached output could be delivered to a different authorized user than the one for whom it was originally generated. One way to prevent that would be to implement your access control for a particular content item as an authorization filter (derived from AuthorizeAttribute) instead of simply enforcing authorization logic inline in an action method, because AuthorizeAttribute knows how to avoid being bypassed by output caching. Test carefully to ensure that authorization and output caching are interacting in the way you expect.

Is this still true in MVC3?

If affirmative, what is the way to prevent that of happening? (because the explanation in the book is too vague).

Regards.

Answer 1

I think it is.

When you are using OutPutCache to cache data, these data are cached globally. As long as a user is authorized, the user will get cached data.

Yes we have "VaryByParam" options for outputcache, but it also creates a new cache for every different parameter passed. which means it's still globally.

So if you want to cache different data based on users, outputcache may not be the right way doing it. If data is user specific, session is the right choice. it's what session lives for