OutputCache and Authorize filters in MVC3

Question

I am reading a book about MVC2, and in the OutputCache section it states:

Warning In the earlier section “How Authorization Filters Interact with Output Caching,” I explained that [Authorize] has special behavior to ensure that unauthorized visitors can’t obtain sensitive information just because it’s already cached. However, unless you specifically prevent it, it’s still possible that cached output could be delivered to a different authorized user than the one for whom it was originally generated. One way to prevent that would be to implement your access control for a particular content item as an authorization filter (derived from AuthorizeAttribute) instead of simply enforcing authorization logic inline in an action method, because AuthorizeAttribute knows how to avoid being bypassed by output caching. Test carefully to ensure that authorization and output caching are interacting in the way you expect.

Is this still true in MVC3?

If affirmative, what is the way to prevent that of happening? (because the explanation in the book is too vague).

Regards.

Roughspoken

Answer 1

I think it is.

When you are using OutPutCache to cache data, these data are cached globally. As long as a user is authorized, the user will get cached data.

Yes we have "VaryByParam" options for outputcache, but it also creates a new cache for every different parameter passed. which means it's still globally.

So if you want to cache different data based on users, outputcache may not be the right way doing it. If data is user specific, session is the right choice. it's what session lives for

Angiology

Great, I'm gonna start a bounty anyway so maybe I can catch more explanations :D Thanks a million. – Roughspoken

So if I use "OutputCacheAttribute.VaryByHeader=Cookie" it will be safe in terms of authorization? What I want to cache is the rendered page, because some of them are large and with a lot of generation logic in it. – Roughspoken

it's an option. but if the inforamtion is critical, propably you should not depends on cookie, which stores at the client side. – Angiology

I see, because if I set the output cache, the call is not authenticated? I mean, the cookie is not checked to be valid? – Roughspoken

then you just need to make sure it's the auth cookie, not other cookies. – Angiology