Cloudflare And CDN Caching

A CDN caches responses near users and can shield the origin, but cache keys and origin headers determine whether content is safe to share.

Why This Matters

Cloudflare can honor or modify origin cache behavior through cache rules. Purging is an operational tool, not a substitute for correct versioning and cache policy.

Working Model

Separate browser caching from shared CDN caching. Define cacheability, key dimensions, TTL, stale behavior, purge scope, and authenticated bypass before enabling edge caching.

Practical Rules

  • Prefer versioned static assets.
  • Use targeted purge by URL or tag where supported.
  • Bypass personalized or authenticated responses unless explicitly partitioned.
  • Normalize query-key policy.
  • Protect against cache poisoning.

Failure Modes

  • Caching Set-Cookie or private account pages publicly.
  • Using purge-everything for routine deploys.
  • Ignoring Vary and content negotiation.
  • Letting attacker-controlled headers enter the cache key unpredictably.

Verification

  • Inspect cache-status headers.
  • Test anonymous and authenticated variants.
  • Change origin headers and purge deliberately.
  • Verify rollback and stale behavior.

Official References

What You Should Be Able To Do

After this lesson, you should be able to explain CDN cache keys, origin directives, purge strategies, authenticated content, and cache-poisoning risk, choose a suitable approach for a real PHP project, and verify the result instead of relying on assumptions.

Practice

Practice: Cache Static Assets

Design Cloudflare and browser caching for hashed assets.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Use immutable versioned URLs, long browser and shared TTLs, deploy new names before HTML, and avoid routine purges.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.

Practice: Protect Private Content

An account endpoint is accidentally eligible for edge caching.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Send private or no-store policy, bypass on authentication, remove shared-cache rules for the path, purge affected objects, and test two accounts for leakage.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.

Practice: Choose A Purge Strategy

A product image changes while its stable URL remains.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Prefer changing to a versioned URL. If that is impossible, purge the exact URL or relevant tag and retain a bounded origin/browser policy.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.