Suppose we have a big JSON document that only certain users can see, but that rarely changes, but which, if it does change, users expect to see the change quite quickly. It makes sense to use etags for this - it saves the whole document being transferred over the wire if it didn't change, yet sends the document if it has.
One risk seems to be that if multiple people use the same browser window:
- Alice signs into the site, and the resource is sent to her with an etag
- Alice signs out and goes to get lunch
- Bob users her browser to sign in as himself - but he can't view the resource
- Bob looks in the browser cache, sees an etag that was stored by the browser, and configures his browser to send that same etag - now Bob can see the data
I suppose that since Bob is already using Alice's browser instance, he could already see what's in the cache and therefore could read the data anyway.