How can a CDN accidentally cache authenticated responses?

If Cache-Control is missing or set to public without private/no-store, CDNs may cache responses that contain session-specific data and serve them to other users.

What should Cache-Control be for API endpoints?

Use Cache-Control: no-store for sensitive API responses. For public API data, max-age=60 or similar short TTL is appropriate.

What does Vary: Origin do?

It tells CDNs to cache separate responses for different Origin headers, preventing one user's CORS response from being served to another.

Your CDN is caching things it shouldn't. EdgeFix audits your caching headers and identifies misconfigurations.

Detects missing Cache-Control, misconfigured Vary headers, accidentally cached authenticated responses, and stale CDN content. Generates fixes for Nginx, Cloudflare, Vercel, Apache, and Express.

URL

EdgeFix fetches your URL and reads the real caching headers — nothing is stored

Detected:

Response headers

Tip: get headers with curl -sI https://your-domain.com

Stack

You might also need

    ⚡Cache-Control Generator
Generate Cache-Control headers for any asset type📊Cache Simulator
Visualise stale-while-revalidate and cache lifecycle⚖️Header Diff
Compare cache headers between staging and production
  

Done with this tool?
20 HTTP checks before you ship — security, CORS, cache, redirects, staging.
Pre-Launch Checklist →

About EdgeFix

What does EdgeFix check?

EdgeFix fetches live response headers from your URL and audits Cache-Control, Vary, Age, X-Cache, and CDN-specific headers. It identifies missing cache policies, accidentally cached authenticated responses, and misconfigured Vary headers that prevent effective caching.

Why is Cache-Control important for CDN performance?

Without a Cache-Control header, CDNs and browsers apply unpredictable default caching behaviour. A missing or incorrect Cache-Control can cause your CDN to bypass cache entirely, sending every request to your origin server.

What is a Vary header misconfiguration?

The Vary header tells caches which request headers affect the response. Vary: * disables caching entirely. Missing Vary: Accept-Encoding means compressed and uncompressed responses may be served incorrectly. EdgeFix flags both patterns.

Is my URL stored or logged?

No. Headers are fetched via a stateless Cloudflare Worker proxy. Your URL is not stored or associated with any account.