Been searching like crazy for hours.
While googling my site to check for certain keywords, I used their site preview function (where you get that little popup with an image representation of the page) that shows Google's cached version of pages on my site.
I always assumed that Google would only be able to see site content available to anonymous users. Am I naive?
To my surprise, this cached version showed content that is only seen in the webbrowser when a site user is logged into my site. The URL for the page in question is the same, only the content changes depending on who is logged in / if the user is anonymous. What is even more troublesome is that it is information that is only visible when a staff user is logged in.
I'm using Django/ModWSGI at the application level. I triple-checked that an anonymous user would not be able to see said content.
Now, unless Google has access to login information of a staff user of my site and using that informtation while crawling my site (which I find hard to believe), the cause should be somewhere on the client side.
Are there webbrowser plugins that push viewed website content to Google for some reason? Of course I'd like to ask my staff users in that case, but this will be more fruitful knowing what to look for. Clients used are Firefox 3.x on Win/Mac/Ubuntu, IE 7/8, Safari on Win/Mac.
How can I defend my site in this respect to avoid such information leakage?
Further observations / information:
I can google my site using keywords that are normally only visible to certain staff users, thus I conclude that Google must have an association of that keyword with my site stored in its database somewhere (at least I am not sure how else it would work).
The webcache version of said page on my site is about a week old (according to Google) and when I view this cached version, the searched keywords are highlighted, even after the webbrowser cleared its own cache and while I am currently not logged into my site.