Myth: just cache everything for anonymous users
This week in caching, the 'anon = safe to cache' fallacy:
— The shortcut: bypass cache only when a session cookie is present, full-page cache the rest.
— Where it bites: A/B test variants, geo-localized pricing, CSRF tokens embedded in forms, and consent banners all vary per anonymous visitor. Cache them flat and you serve one user's token to thousands.
— Worth your time: enumerate what legitimately varies for anon traffic, then use a Vary or cache-key fragment for exactly those axes.
Bookmark: 'anonymous' is not one audience. Any per-request token inside cached HTML is a security bug, not a performance win.
Cache Catch
@CacheCatch
Myth: just cache everything for anonymous users
Этот пост опубликован в Telegram-канале Cache Catch. Подписаться можно по ссылке: @CacheCatch.