Made a website in drupal 8, and using webforms to save some webform submissions.

Made a custom url to show the submission data the way I want, for the sake of the example let's say: /submissiondata/[submission_id]/[submission_token]

anonymous users can see that page, and made sure that the page is not cached- by adding options: no_cache: 'true' in the routing.yml file and also when returning data, returning it like this:

return array('#markup' => $html, '#cache' => ['max-age' => 0,]);

Some extra info: When showing this info, the user has only 5 min. to see this page, because I compare CREATED to CURRENT_TIME - and deliver some other HTML if more than 5 min. passed.

the apache server is setup with some reverse proxy...

Here is the issue: Sometimes, a person sees another persons submission data, just by surfing around the website. Like clicking the logo and going to the front page, they don't see the front page, but see submission data of another person!

How the heck is that possible?? It's happens very rarely, but it happens! It should not be possible! Is this a Drupal issue?

1 Answer 1


"The apache server is setup with some reverse proxy..." then you have to provide the correct response headers in an event subscribers, see How to embed drupal content in other sites (remove X-Frame-Options: SAMEORIGIN)? how to set response headers.

Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control

And uninstall the module Internal Page Cache, because this built in reverse proxy doesn't respect Cache-Control headers and you don't need it, because you already cache outside of Drupal, see PageCache caching uncacheable responses (violating HTTP/1.0 spec) + D8 intentionally disabling HTTP/1.0 proxies = WTF

  • Would this explain a user goes to domain.com (front page) and not see the front page, but some other page?
    – Raf A.
    Jan 8, 2018 at 11:47
  • Actually the problem was apache on windows bug. It mixed the sessions together.
    – Raf A.
    Jan 16, 2018 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.