09 · Cache patterns for CMS, SaaS, and AI-built applications
Partition CMS, SaaS, image, and PDF tools by visibility, identity, method, and lifecycle so dynamic pages from AI-generated code never enter cache accidentally.
Edited and verified by Orange Book Editorial Team ·
What AI-built application means here
This chapter covers ordinary applications built with help from ChatGPT, Codex, Cursor, or similar tools: SaaS products, CMSs, image converters, PDF processors, and business utilities. It does not mean only AI agents, chatbots, or model APIs. HTTP behavior and data privacy define the cache boundary, regardless of who wrote the code.
Ask four questions about every route
flowchart TD
A[A URL or route] --> B{Same response for every user?}
B -- No --> X[Bypass shared cache]
B -- Yes --> C{Safe read only?}
C -- No --> X
C -- Yes --> D{Identity input or Set-Cookie output?}
D -- Yes --> X
D -- No --> E{New URL or targeted purge on change?}
E -- No --> F[Short Edge TTL + revalidation]
E -- Yes --> G[Eligible + lifecycle-based TTL]A public URL is not necessarily a public response. When one URL varies by Cookie, Authorization, tenant, country, language, experiment, or permission, prove that the cache key represents every variant. For a beginner, bypass is usually safer until that proof exists.
Recommended partitions for three application types
| Area | Example | Initial policy |
|---|---|---|
| Fingerprinted assets | Theme JS/CSS, public thumbnails | Long Edge and Browser TTL |
| Published content | Articles, categories, public feed | Short Edge TTL; targeted purge after publishing |
| Preview and admin | /preview/*, /admin/* | Bypass; preserve identity and draft cookies |
| Search and personalization | Site search, recommendations, member content | Bypass first, then separate genuinely public cases |
A reusable application split
www.example.com Public marketing and docs; HTML cached cautiously
app.example.com Signed-in SaaS/CMS workspace; dynamic content bypassed
assets.example.com Fingerprinted static assets; long TTL
files.example.com Uploads and results; authorize by object visibilityHost separation is not a security control by itself, but it makes rules, monitoring, and certificates easier to reason about. Do not let a Cache Everything rule for www unintentionally include app or files.
Common cache mistakes in AI-generated code
| Mistake | Why it is dangerous | Correction |
|---|---|---|
| "Every GET is cacheable" | GET can vary by Cookie or even cause a mistaken side effect | Audit identity, response headers, and business action together |
| "Query parameters isolate users" | Values can be guessed, omitted, or contain secrets | Bypass private responses; a URL is not authorization |
| "A short TTL prevents leaks" | Even one second of shared cache can reach the wrong user | Keep private content out of shared cache entirely |
| "Purging Cloudflare recalls every copy" | Fresh browser cache cannot be remotely purged | Use short Browser TTL or versioned URLs for mutable content |
| "HIT means optimization worked" | A hit on billing or a private file is an incident signal | Correctness and cross-user isolation are the primary gates |
Test two identities and three actions before launch
Anonymous client
Visit marketing, public content, and assets twice. Record CF-Cache-Status, Age, cache-control headers, and whether any personalized data appears.
Account A and account B
Sign in, view the dashboard, update a profile, and sign out independently. HTML, JSON, download URLs, and error pages must never cross accounts. Confirm the first page preserves Set-Cookie and CSRF state.
Create, revoke, and publish
Publish and unpublish CMS content, revoke a SaaS public share, and delete an image/PDF result. Record the worst time until neither edge nor browser serves the old content. If it exceeds the requirement, design targeted invalidation in the next phase.
Continue with cache key security, release invalidation, and tiered cache. First, make every private route on this page reliably bypass shared cache.
Primary sources
Did this page help you complete your goal?
Beta feedback is generated in this browser and is never uploaded automatically.
08 · Edge TTL, Browser TTL, and cache response headers
Separate browser, Cloudflare edge, and origin cache lifetimes, then use Cache-Control and CDN-Cache-Control to build an updateable release policy.
10 · Cache keys and cache security
Decide which query parameters, headers, cookies, and user dimensions truly change a response to prevent fragmentation, cross-user reuse, and web cache poisoning.