When an originless Agent composes redirect and shared cache interceptors, the system determines whether to store the final response under the original request key by inspecting only the final redirect hop. This allows a redirect that passes through an untrusted origin and returns to a trusted origin to be cached under the trusted key. Consequently, the `Vary` header of an intermediate hop may be dropped, potentially serving responses that vary on `Authorization` or `Cookie` to different users. Additionally, the `no-cache` or `default-uncacheable` status of an intermediate hop may be ignored, allowing a non-storable redirect to be treated as a cacheable entry. An attacker controlling a redirect target from a trusted URL could poison the cached entry or cause a private, per-user response to be served to subsequent callers.