The session storage key is the object name alone, so two pages on one origin that share an object name but use different resource configurations or endpoints read each other's cached payload and property flags. One can complete from the other's response without running its own snippets or calling its own callback URL, leaving its client-evidence properties unresolved for the life of the tab. The default object name is fod, so this needs no unusual setup to hit.
Either include the callback URL's origin and path in the key, or document object-name uniqueness as a requirement for integrators.
If the key route is taken, exclude the query string: pipeline-java renders the page view's own query evidence into the callback URL, so including it would put the key back to changing on every page view.
The session storage key is the object name alone, so two pages on one origin that share an object name but use different resource configurations or endpoints read each other's cached payload and property flags. One can complete from the other's response without running its own snippets or calling its own callback URL, leaving its client-evidence properties unresolved for the life of the tab. The default object name is
fod, so this needs no unusual setup to hit.Either include the callback URL's origin and path in the key, or document object-name uniqueness as a requirement for integrators.
If the key route is taken, exclude the query string: pipeline-java renders the page view's own query evidence into the callback URL, so including it would put the key back to changing on every page view.