Cache public pages at the edge for a few seconds

How to do it

A page that changes every minute still gets thousands of identical requests in that minute. A shared cache that keeps it for 5 seconds sends the app at most one request per page every 5 seconds, whatever the traffic. Set Cache-Control: public, max-age=0, s-maxage=5, stale-while-revalidate=30, so browsers ask again and the shared cache answers. Turn on request collapsing, such as proxy_cache_lock in nginx, so the first miss fetches the page and the rest wait for it. Only pages that are the same for every visitor qualify. Never cache a signed-in page in a shared cache, as Keep private pages out of shared caches says. Longer lifetimes for files are in Cache files for a year and pages briefly.

Examples

nginx example

proxy_cache_path /var/cache/nginx keys_zone=pages:10m max_size=1g;

location /products {
    proxy_cache pages;
    proxy_cache_lock on;
    proxy_cache_use_stale updating error timeout;
    proxy_cache_bypass $cookie_session;
    proxy_no_cache $cookie_session;
    proxy_pass http://shop_app;
}

JavaScript example

app.get('/products', async (req, res) => {
  res.set('Cache-Control', 'public, max-age=0, s-maxage=5, stale-while-revalidate=30');
  res.json(await listProducts());
});

Python example

@app.get("/products")
def products(response: Response):
    response.headers["Cache-Control"] = "public, max-age=0, s-maxage=5, stale-while-revalidate=30"
    return list_products()

How to check

Send 1,000 requests for one public page within 5 seconds through the edge. The app's access log shows at most 2 requests for that page. A request with a session cookie for a signed-in page reaches the app every time.

Sources

• RFC 9111 section 5.2.2.10 s-maxage
• nginx proxy module, proxy_cache_lock

Related rules

• APS-46 Keep private pages out of shared caches in Application security
• WEB-42 Cache files for a year and pages briefly in Website