How can a CDN accidentally cache authenticated responses?

If Cache-Control is missing or set to public without private/no-store, CDNs may cache responses that contain session-specific data and serve them to other users.

What should Cache-Control be for API endpoints?

Use Cache-Control: no-store for sensitive API responses. For public API data, max-age=60 or similar short TTL is appropriate.

What does Vary: Origin do?

It tells CDNs to cache separate responses for different Origin headers, preventing one user's CORS response from being served to another.

Your CDN is caching things it shouldn't. EdgeFix audits your caching headers and finds exactly what's wrong.

Detects missing Cache-Control, misconfigured Vary headers, accidentally cached authenticated responses, and stale CDN content. Generates fixes for Nginx, Cloudflare, Vercel, Apache, and Express.

URL

EdgeFix fetches your URL and reads the real caching headers — nothing is stored

Detected:

Response headers

Tip: get headers with curl -sI https://your-domain.com

Stack