"Cache everything" wrecked a checkout

"Cache everything" wrecked a checkout
A Toronto outdoor-gear store read a blog telling them to cache everything at the edge for speed. They set a blanket 1-day TTL on all routes.
The problem: logged-in users saw each other's carts, and the /account page leaked the previous visitor's name. Cache-hit ratio looked gorgeous at 94%, but support tickets exploded.
What we changed: we split the cache key. Static assets and product pages stayed cached; anything behind auth got Cache-Control private plus a Vary on the session cookie, bypassing the edge entirely.
Result: zero leaked sessions, cache-hit ratio settled at a healthy 81% on the routes that should be cached, and Toronto TTFB held at 31ms.
"Cache everything" is the fastest way to cache the wrong thing.
The number that mattered: 0 leaked sessions after the cache-key split.