[dminor]

Years ago I added varnish in front of a website to cache image requests, not realizing that if the response included 'set-cookie' that was also cached.

We immediately started getting reports of random products appearing in our customers' shopping carts, as people's sessions got merged with random strangers.

[Puts]

Just feel the urge to point out that Varnish by default do specifically not cache requests with a set-cookie header. :)