Summary
/favicon/proxied appears to return the same image for different input URLs.
This is reproducible on meta.discourse.org, so it is not instance-specific.
Reproduction
Test with two different images:
Image A:
https://d11a6trkgmumsb.cloudfront.net/original/4X/6/1/4/6144f7183b605c2c615a2f18a238a0788fe5f4c9.png
Image B:
https://h2cdn.appinn.me/original/3X/9/f/9fd7005050c813d23be27f02f7bc8b63b6b254ba.png
Access via:
https://meta.discourse.org/favicon/proxied?https%3A%2F%2Fd11a6trkgmumsb.cloudfront.net%2Foriginal%2F4X%2F6%2F1%2F4%2F6144f7183b605c2c615a2f18a238a0788fe5f4c9.png
https://meta.discourse.org/favicon/proxied?https%3A%2F%2Fh2cdn.appinn.me%2Foriginal%2F3X%2F9%2Ff%2F9fd7005050c813d23be27f02f7bc8b63b6b254ba.png
Actual behavior
- Different input URLs return the same image
- The response does not correspond to the requested URL
- Appears to be a cache collision or incorrect cache key
Expected behavior
- Each URL should return its corresponding image
- Cache (if any) should be keyed by the full source URL
Notes
- Reproducible on official Meta instance
- Not related to CDN or local configuration
- Persists across different images and requests
Hypothesis
This may be caused by incorrect caching logic (e.g. cache key not including the full URL or improper normalization).