Guide · deployment and incidents
Cache deployment and incident runbook
Choose a safe private or public path before deployment, then identify the layer that served old content before you purge anything.
Start here
- Private or sensitive: use
no-storewhen HTTP-cache retention is unacceptable, orprivate, no-cachewhen browser retention with validation is acceptable. Keep the route out of shared caching and review the effective key. - Public or versioned: confirm the representation is equivalent for its intended audience, set separate
max-age/s-maxagevalues, use validators, and publish a new URL when bytes change. - During an incident: ask whether a network request occurred; capture named-hop evidence; compare a fresh client and the affected browser; then record a redacted origin marker and counter.
Choose the path
Private / sensitive
- List cookies, authorization, tenant, role, query, language, device, geography, and server-state inputs.
- Audit shared-cache rules, key dimensions, workers, application caches, and service-worker Cache Storage.
- Use a harmless synthetic marker only with authorization. A purge is containment, not a privacy guarantee.
Public / versioned
- Confirm identical public bytes and keep changed assets on new fingerprinted URLs.
- Separate browser
max-agefrom shareds-maxage; add ETag or Last-Modified for mutable content. - Use a named-provider purge only for its documented scope, then verify the same URL from a named vantage.
Evidence labels
| Label | Meaning |
|---|---|
| Standards-stable | HTTP storage audience, freshness precedence, validators, request variants, and named evidence such as Age or optional Cache-Status. |
| Vendor-specific | CloudFront TTL bounds and invalidation, or Cloudflare OCC, Cache Rules, Browser TTL, keys, status fields, and purge methods. |
| Live-topology-required | Actual rule/key match, POP or tier, stored object, origin counter, browser state, downstream proxy, or purge follow-up. |
What a clean result does not prove
No request may be history/back-forward cache or a service worker. A named cache hit is evidence for that request at that named hop. An origin counter increment proves that the instrumented origin received a request. None of these observations clears browser, service-worker, corporate-proxy, other-edge, or application copies.