Caching authenticated content at the edge

Edge caching can reduce origin load, but an incomplete variation key can expose one user’s response to another more quickly than the application could do alone.

Classify responses first

Separate public, privately personalised and sensitive responses by route and state. Default authenticated responses to private or no-store until a documented design proves which content is safe to share.

Control the cache key

Vary only on normalised values that change the representation. Cookies, authorisation headers, language and device rules require explicit treatment; unbounded variation can destroy efficiency while omitted state can disclose data.

Test isolation and invalidation

Use two accounts with recognisably different data and repeat requests through each edge location. Verify logout, permission changes, purge propagation, stale-on-error behaviour and responses produced when the origin is unavailable.