Drupal (or perhaps Apache) delivers wrong page

Question

Made a website in drupal 8, and using webforms to save some webform submissions.

Made a custom url to show the submission data the way I want, for the sake of the example let's say: /submissiondata/[submission_id]/[submission_token]

anonymous users can see that page, and made sure that the page is not cached- by adding options: no_cache: 'true' in the routing.yml file and also when returning data, returning it like this:

return array('#markup' => $html, '#cache' => ['max-age' => 0,]);

Some extra info: When showing this info, the user has only 5 min. to see this page, because I compare CREATED to CURRENT_TIME - and deliver some other HTML if more than 5 min. passed.

the apache server is setup with some reverse proxy...

Here is the issue: Sometimes, a person sees another persons submission data, just by surfing around the website. Like clicking the logo and going to the front page, they don't see the front page, but see submission data of another person!

How the heck is that possible?? It's happens very rarely, but it happens! It should not be possible! Is this a Drupal issue?

Answer 1

"The apache server is setup with some reverse proxy..." then you have to provide the correct response headers in an event subscribers, see How to embed drupal content in other sites (remove X-Frame-Options: SAMEORIGIN)? how to set response headers.

Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control

And uninstall the module Internal Page Cache, because this built in reverse proxy doesn't respect Cache-Control headers and you don't need it, because you already cache outside of Drupal, see PageCache caching uncacheable responses (violating HTTP/1.0 spec) + D8 intentionally disabling HTTP/1.0 proxies = WTF