A microcache that learned every cookie
nginx cached HTML per auth_token. Hit rate died. Public pages do not need that cookie in the key.
Anonymous catalog pages still missed the nginx microcache. The cache key included the Cookie header. Sanctum puts auth_token on the session after login, and analytics cookies arrive before that. Every visitor got a unique key. The two-second cache never saw a second hit.
The dangerous version of the same bug is the opposite: cache public HTML for a signed-in response. That is how a private fragment leaks. The rule has to name both sides.
The problem was treating Cookie as a cache dimension. Hit rate died for anonymous shoppers. A signed-in HTML in the public slot would have been worse. I needed auth_token as a bypass bit, not as part of the key.
The split
nginx looks at the auth_token cookie only. If it is missing, the key is scheme, host, uri, locale. Query strings that do not change the page stay out. If the cookie is present, proxy_cache_bypass is on, and proxy_no_cache is on. PHP still talks to Memcached for fragments. nginx does not store the personalized document.
Logout clears the cookie on the API host. The next anonymous hit can reuse the public slot. Login does not poison it, because that response was never written there.
- SameSite and httpOnly stay on auth_token. JavaScript never reads it.
- Admin routes are not in the microcache map at all.
- Vary is locale, not Cookie.
Hit rate on the listing came back. Signed-in HTML never appeared in the anonymous slot. The cookie stayed a credential, not a cache dimension.
What I took from this
A cache key that includes Cookie is a unique key per visitor. Analytics cookies make that true before anyone logs in.
Bypass on a named credential is safer than Vary: Cookie. Vary on Cookie still stores N copies and still risks a signed-in write into a public slot if the rule is sloppy.
auth_token stays httpOnly. The edge and nginx may look at presence. JavaScript still never reads it.