More screenshots

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    Repair NGINX Proxy Cache Vary Header Bleed

    1

    Find NGINX cache key and Vary handling errors that serve the wrong response variant.

    $1

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Repair NGINX Proxy Cache Vary Header Bleed

    Repair NGINX Proxy Cache Vary Header Bleed

    Example session with this skill installed

    Two clients with different language headers receive the same cached localized response.

    Available evidence: NGINX cache configuration and request header captures (partial extracts only). Additional sources requested: response Vary headers and cache hit and miss logs. Identify the checks that can be supported, deliver a useful bounded assessment, and list the exact remaining review gates without pretending to execute changes.

    • Read your context and instructions
    • Compiled the repair nginx proxy

    Repair NGINX Proxy Cache Vary Header Bleed — EVIDENCE-LIMITED REVIEW

    Scenario received

    Two clients with different language headers receive the same cached localized response.

    Evidence inventory

    • S1: NGINX cache configuration — partial extract described by the requester; original full source not provided here.
    • S2: request header captures — partial extract described by the requester; original full source not provided here.
    • S3: response Vary headers — NOT PROVIDED; required to validate dependent findings.
    • S4: cache hit and miss logs — NOT PROVIDED; required to validate dependent findings.

    Case-specific checks

    Map cache key composition. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
    2.

    Compare header variants across clients. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
    3.

    Test authorization sensitive bypasses. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
    4.

    Propose isolated cache regression probes. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.

    Deliverables

    Cache variant mismatch matrix. Create an evidence-linked section with observations, missing data, owner and next validation step.

    NGINX change proposal. Create an evidence-linked section with observations, missing data, owner and next validation step.

    Cross client safety test plan. Create an evidence-linked section with observations, missing data, owner and next validation step.

    Acceptance gate

    Cache changes protect user specific content and reproduce correct variant isolation. Do not label this gate passed until supplied source records actually demonstrate it.

    Verdict and next action

    INCOMPLETE — evidence required. Request S3 and S4 from the authorized owner, reconcile them with S1 and S2, then repeat the four checks and log remaining conflicts. No production change, approval, communication, or test run is claimed.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Misconfigured NGINX caches often leak private data or serve incorrect language variants to users. This skill audits your proxy configurations and headers to stop cross-client cache bleed. It ensures your proxy_cache_key and Vary logic correctly isolate responses.

    What it does

    • Map cache keys by analyzing NGINX configuration files to see how responses are indexed.
    • Compare header variants to identify where different client requests (like Accept-Language) collide.
    • Test auth bypasses to ensure sensitive Authorization or Cookie headers do not result in cached private data.
    • Draft regression probes to verify that proposed configuration changes actually fix the isolation logic.

    How it works

    1. Supply your NGINX configuration, request/response header captures, and cache logs.
    2. The skill builds a source register to map every observation to a specific line in your logs or config.
    3. It generates a mismatch matrix showing where the proxy serves the wrong variant.
    4. It provides a specific NGINX change proposal to fix the cache key or Vary handling.

    Frameworks & tools

    This skill works with NGINX Open Source and NGINX Plus configurations, focusing on ngx_http_proxy_module and ngx_http_upstream_module directives.

    Why this beats prompting it yourself

    Generic prompts often miss how proxy_cache_key interacts with upstream Vary headers. This skill uses a strict evidence gate to ensure fixes are based on your actual traffic logs, not hypothetical scenarios.

    Use cases

    • Fix localized content bleeding where a French user sees an English cached page.
    • Prevent session hijacking caused by caching Set-Cookie headers.
    • Debug why proxy_no_cache or proxy_cache_bypass directives are ignored.
    • Audit proxy setups before deploying a new CDN or load balancer.

    Known limitations

    Does not perform live traffic injection or deployments. Requires manual provision of NGINX logs and configuration files. Domain-sensitive outcomes require human review before implementation.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for APIs & Backend.

    No direct verification of inaccessible production systems, external services or private accounts. Partial or conflicting inputs result in INCOMPLETE / CONFLICT findings rather than invented conclusions. Domain-sensitive decisions require qualified owner review.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 26 days ago

    Permissions

    Read Files

    Provide only materials you are authorized to share. Use a reviewed environment for proposed changes; keep deployment, production modifications, and third-party communication under explicit human approval.

    Listed26 days ago
    Updated9 days ago

    What's inside

    Frequently Asked Questions

    This skill specifically addresses 'cache bleed,' where NGINX serves one user's private data or specific language variant to another user due to misconfigured proxy keys or Vary headers. It identifies these isolation failures and provides a corrected configuration to ensure secure, accurate content delivery.

    You will need to provide your NGINX configuration files (`nginx.conf`), sample request/response header captures, and relevant cache logs. The skill uses this data to build a mismatch matrix and trace the root cause of the leakage within your specific environment.

    This skill is compatible with any AI agent or platform that supports file uploads and text-based reasoning, including NGINX Open Source and NGINX Plus environments. It focuses on the `ngx_http_proxy_module` and `ngx_http_upstream_module` directives.

    Your purchase includes the logic to map cache keys, a tool to generate a mismatch matrix for variant collisions, and a specific NGINX change proposal. You also get a set of regression probes to verify the fix works as intended before you deploy it.

    While it identifies vulnerabilities like session hijacking via `Set-Cookie` caching, it does not perform live traffic injection or automated deployments. It provides the audited code and logic, which must be manually reviewed and applied by a human administrator to ensure production safety.

    New in APIs & Backend