A session cookie made every page uncacheable

A session cookie made every page uncacheable

A forum in Buenos Aires had a 0% cache-hit ratio on its public threads. Not low, zero. Every response carried a Set-Cookie from a session middleware that ran on every route, and the CDN refuses to cache anything with Set-Cookie by default. Millions of anonymous thread views all hammered a single origin.

We split the logic: session cookies only set on authenticated and POST routes, and at the edge we stripped Set-Cookie from public GET responses so they became cacheable. Logged-in users still got their cookies on the paths that needed them.

Cache-hit ratio went from 0% to 92%. Origin requests fell 90% overnight. Public thread TTFB dropped from 420 ms to 55 ms across South America. The origin database, formerly at 85% CPU, settled at 19%.

The number that mattered: 0% to 92% cache hits, by removing one cookie.