An anonymous cache key is the value a web cache uses to separate responses for logged-out users. It should ensure that pages generated for one anonymous request are not reused for another user when the content may differ because of cookies, headers, locale, or other request data.
This matters because weak cache separation can turn a single malicious request into a shared response. In attacks, an attacker may supply crafted input that changes a cached page, causing injected HTML or script to be served to many visitors. Defenders reduce this risk by making cache keys include every input that can safely affect the page, and by avoiding caching of responses that contain user-controlled content. Proper anonymous cache keys are a core control against cache poisoning and cache-assisted XSS.