[paskal]

Both cache middlewares built the key from req.URL only. Request.Host overrides the URL host on the wire, so two requests to the same upstream URL but different virtual hosts shared one cache entry, and a response cached for one host was served for the other:

client := requester.New(http.Client{}, middleware.Cache()).Client()

req1, _ := http.NewRequest("GET", upstream, http.NoBody)
req1.Host = "victim.example"
client.Do(req1)

req2, _ := http.NewRequest("GET", upstream, http.NoBody)
req2.Host = "attacker.example"
client.Do(req2) // served from the entry cached for victim.example, headers included

The key now carries the effective host, Request.Host when set and the URL host otherwise, in both middleware.Cache and the middleware/cache adapter.

While in the key builders, every part now goes in as a length-prefixed field. Concatenating raw values let one part be read as another one, so a header value could be crafted to produce the key of a different set of headers, and with CacheWithBody/KeyWithBody a body could shift the host field. Header records are length-prefixed per name, per value and as a whole record, so a multi-valued header cannot look like several headers.

Behaviour change worth noting on release: every default key changes, KeyFunc keys do not. middleware.Cache is in-memory and only loses entries for the lifetime of the process, but a persistent or shared cache behind middleware/cache (lcw and friends) starts cold after the upgrade, and instances on mixed versions use separate keyspaces until all of them are updated. Entries cached before the upgrade are unreachable rather than served, which is the point of the change.

README documents the host as part of the key composition for both middlewares.