{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/", "item": { "id": "https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/", "slug": "do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied", "url": "https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied.md", "json": "https://update.dsesecurity.com/api/v1/posts/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/" }, "title": "Do not expect Cloudflare to cache HTML or JSON merely because it is proxied", "summary": "Default extension-based eligibility differs from an application response's MIME type.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:34+00:00", "modified_at": "2026-10-20T18:34:35+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 260, "potentially_affected": "This concerns Cloudflare's default CDN cache behavior.", "dse_recommendation": "DSE recommends inventorying the actual URL shapes of static assets and application endpoints before setting performance expectations.", "primary_source": { "name": "Cloudflare — Default Cache Behavior", "url": "https://developers.cloudflare.com/cache/concepts/default-cache-behavior/", "published_on": null, "authority": "developers.cloudflare.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Default extension-based eligibility differs from an application response’s MIME type.

\n

Source facts

\n

Cloudflare states that its default CDN behavior determines cache eligibility by file extension rather than MIME type and does not cache HTML or JSON by default. Cache Rules can change eligibility. The guide also documents request collapsing for concurrent misses at one data center, where waiting requests share the first origin fetch for the same asset.

\n

Source: Cloudflare — Default Cache Behavior.

\n

Applicability

\n

This concerns Cloudflare’s default CDN cache behavior.

\n

DSE recommendation

\n

DSE recommends inventorying the actual URL shapes of static assets and application endpoints before setting performance expectations. Keep authenticated HTML and user-specific JSON outside broad caching rules unless their cache-key and privacy design is deliberately reviewed. Use a clearly versioned public asset for initial acceptance rather than interpreting a dynamic page’s lack of HIT as a proxy fault. Document any explicit extensionless or HTML caching rule with its owner and intended response classes. Give the performance review an explicit list of endpoints expected to remain dynamic. Ask the reviewer to classify them before looking at hit rate, so healthy uncached application responses are not counted as failed static delivery or used to justify an indiscriminate cache-everything rule.

\n

Verification

\n

Inspect repeated requests for one default-eligible static asset and one ordinary HTML or JSON endpoint. Compare the resulting status with matching rules and origin headers. If testing request collapsing, use a controlled concurrent workload and origin evidence; do not claim that one observed fetch represents every data center or request pattern.

\n

Official reference

\n

Cloudflare — Default Cache Behavior. Reviewed October 20, 2026.

", "content_text": "Default extension-based eligibility differs from an application response’s MIME type.\nSource facts\nCloudflare states that its default CDN behavior determines cache eligibility by file extension rather than MIME type and does not cache HTML or JSON by default. Cache Rules can change eligibility. The guide also documents request collapsing for concurrent misses at one data center, where waiting requests share the first origin fetch for the same asset.\nSource: Cloudflare — Default Cache Behavior.\nApplicability\nThis concerns Cloudflare’s default CDN cache behavior.\nDSE recommendation\nDSE recommends inventorying the actual URL shapes of static assets and application endpoints before setting performance expectations. Keep authenticated HTML and user-specific JSON outside broad caching rules unless their cache-key and privacy design is deliberately reviewed. Use a clearly versioned public asset for initial acceptance rather than interpreting a dynamic page’s lack of HIT as a proxy fault. Document any explicit extensionless or HTML caching rule with its owner and intended response classes. Give the performance review an explicit list of endpoints expected to remain dynamic. Ask the reviewer to classify them before looking at hit rate, so healthy uncached application responses are not counted as failed static delivery or used to justify an indiscriminate cache-everything rule.\nVerification\nInspect repeated requests for one default-eligible static asset and one ordinary HTML or JSON endpoint. Compare the resulting status with matching rules and origin headers. If testing request collapsing, use a controlled concurrent workload and origin evidence; do not claim that one observed fetch represents every data center or request pattern.\nOfficial reference\nCloudflare — Default Cache Behavior. Reviewed October 20, 2026.", "content_markdown": "Default extension-based eligibility differs from an application response’s MIME type.\n\n## Source facts\n\nCloudflare states that its default CDN behavior determines cache eligibility by file extension rather than MIME type and does not cache HTML or JSON by default. Cache Rules can change eligibility. The guide also documents request collapsing for concurrent misses at one data center, where waiting requests share the first origin fetch for the same asset.\n\nSource: [Cloudflare — Default Cache Behavior](https://developers.cloudflare.com/cache/concepts/default-cache-behavior/).\n\n## Applicability\n\nThis concerns Cloudflare’s default CDN cache behavior.\n\n## DSE recommendation\n\nDSE recommends inventorying the actual URL shapes of static assets and application endpoints before setting performance expectations. Keep authenticated HTML and user-specific JSON outside broad caching rules unless their cache-key and privacy design is deliberately reviewed. Use a clearly versioned public asset for initial acceptance rather than interpreting a dynamic page’s lack of HIT as a proxy fault. Document any explicit extensionless or HTML caching rule with its owner and intended response classes. Give the performance review an explicit list of endpoints expected to remain dynamic. Ask the reviewer to classify them before looking at hit rate, so healthy uncached application responses are not counted as failed static delivery or used to justify an indiscriminate cache-everything rule.\n\n## Verification\n\nInspect repeated requests for one default-eligible static asset and one ordinary HTML or JSON endpoint. Compare the resulting status with matching rules and origin headers. If testing request collapsing, use a controlled concurrent workload and origin evidence; do not claim that one observed fetch represents every data center or request pattern.\n\n## Official reference\n\n[Cloudflare — Default Cache Behavior](https://developers.cloudflare.com/cache/concepts/default-cache-behavior/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/", "url": "https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Do not expect Cloudflare to cache HTML or JSON merely because it is proxied", "item": "https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/#article", "identifier": "https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/", "url": "https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/", "headline": "Do not expect Cloudflare to cache HTML or JSON merely because it is proxied", "description": "Default extension-based eligibility differs from an application response's MIME type.", "abstract": "Default extension-based eligibility differs from an application response's MIME type.", "articleBody": "Default extension-based eligibility differs from an application response’s MIME type.\nSource facts\nCloudflare states that its default CDN behavior determines cache eligibility by file extension rather than MIME type and does not cache HTML or JSON by default. Cache Rules can change eligibility. The guide also documents request collapsing for concurrent misses at one data center, where waiting requests share the first origin fetch for the same asset.\nSource: Cloudflare — Default Cache Behavior.\nApplicability\nThis concerns Cloudflare’s default CDN cache behavior.\nDSE recommendation\nDSE recommends inventorying the actual URL shapes of static assets and application endpoints before setting performance expectations. Keep authenticated HTML and user-specific JSON outside broad caching rules unless their cache-key and privacy design is deliberately reviewed. Use a clearly versioned public asset for initial acceptance rather than interpreting a dynamic page’s lack of HIT as a proxy fault. Document any explicit extensionless or HTML caching rule with its owner and intended response classes. Give the performance review an explicit list of endpoints expected to remain dynamic. Ask the reviewer to classify them before looking at hit rate, so healthy uncached application responses are not counted as failed static delivery or used to justify an indiscriminate cache-everything rule.\nVerification\nInspect repeated requests for one default-eligible static asset and one ordinary HTML or JSON endpoint. Compare the resulting status with matching rules and origin headers. If testing request collapsing, use a controlled concurrent workload and origin evidence; do not claim that one observed fetch represents every data center or request pattern.\nOfficial reference\nCloudflare — Default Cache Behavior. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:34+00:00", "dateModified": "2026-10-20T18:34:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not expect Cloudflare to cache HTML or JSON merely because it is proxied" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 260, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — Default Cache Behavior", "url": "https://developers.cloudflare.com/cache/concepts/default-cache-behavior/" } } ] } }