Made a website in drupal 8, and using webforms to save some webform submissions.
Made a custom url to show the submission data the way I want, for the sake of the example let's say: /submissiondata/[submission_id]/[submission_token]
anonymous users can see that page, and made sure that the page is not cached- by adding
options: no_cache: 'true' in the routing.yml file and also when returning data, returning it like this:
return array('#markup' => $html, '#cache' => ['max-age' => 0,]);
Some extra info: When showing this info, the user has only 5 min. to see this page, because I compare CREATED to CURRENT_TIME - and deliver some other HTML if more than 5 min. passed.
the apache server is setup with some reverse proxy...
Here is the issue: Sometimes, a person sees another persons submission data, just by surfing around the website. Like clicking the logo and going to the front page, they don't see the front page, but see submission data of another person!
How the heck is that possible?? It's happens very rarely, but it happens! It should not be possible! Is this a Drupal issue?