{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges/", "item": { "id": "https://update.dsesecurity.com/updates/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges/", "slug": "emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges", "url": "https://update.dsesecurity.com/updates/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges.md", "json": "https://update.dsesecurity.com/api/v1/posts/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges/" }, "title": "Emit Cloudflare cache tags from the origin before relying on content-group purges", "summary": "A purge tag works only when cached responses were associated with that tag.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:45+00:00", "modified_at": "2026-10-20T18:34:36+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 253, "potentially_affected": "This concerns Cloudflare tag-based cache invalidation.", "dse_recommendation": "DSE recommends designing tags around content dependencies such as a product, section, or shared component rather than opaque deployment accidents.", "primary_source": { "name": "Cloudflare — Purge cache by cache-tags", "url": "https://developers.cloudflare.com/cache/how-to/purge-cache/purge-by-tags/", "published_on": null, "authority": "developers.cloudflare.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A purge tag works only when cached responses were associated with that tag.

\n

Source facts

\n

Cloudflare documents adding Cache-Tag response headers at the origin so cached content can be invalidated as a group. Several tags can describe one response, allowing a content dependency to span multiple URLs. Cloudflare removes the header before forwarding it to visitors or Workers, so its absence in the visitor response does not show that origin tagging failed.

\n

Source: Cloudflare — Purge cache by cache-tags.

\n

Applicability

\n

This concerns Cloudflare tag-based cache invalidation.

\n

DSE recommendation

\n

DSE recommends designing tags around content dependencies such as a product, section, or shared component rather than opaque deployment accidents. Ensure the origin emits the intended tags on every affected response and keeps their naming stable across releases. Restrict purge credentials and account for the origin traffic needed to refill a large tag group. Keep an untagged control resource in acceptance testing. Ask the content owner to nominate one dependency that spans several URLs, then show where the origin assigns its shared tag. Keep a missing-tag example in the rehearsal to expose incomplete tagging before a release relies on a group purge for correctness.

\n

Verification

\n

Inspect the controlled origin response for the intended tag, populate several related cached URLs, and update their revision markers. Purge the tag and verify all affected resources refresh while the unrelated control remains unchanged. Confirm tagging at the origin instead of expecting the stripped header to appear in a public browser response.

\n

Official reference

\n

Cloudflare — Purge cache by cache-tags. Reviewed October 20, 2026.

", "content_text": "A purge tag works only when cached responses were associated with that tag.\nSource facts\nCloudflare documents adding Cache-Tag response headers at the origin so cached content can be invalidated as a group. Several tags can describe one response, allowing a content dependency to span multiple URLs. Cloudflare removes the header before forwarding it to visitors or Workers, so its absence in the visitor response does not show that origin tagging failed.\nSource: Cloudflare — Purge cache by cache-tags.\nApplicability\nThis concerns Cloudflare tag-based cache invalidation.\nDSE recommendation\nDSE recommends designing tags around content dependencies such as a product, section, or shared component rather than opaque deployment accidents. Ensure the origin emits the intended tags on every affected response and keeps their naming stable across releases. Restrict purge credentials and account for the origin traffic needed to refill a large tag group. Keep an untagged control resource in acceptance testing. Ask the content owner to nominate one dependency that spans several URLs, then show where the origin assigns its shared tag. Keep a missing-tag example in the rehearsal to expose incomplete tagging before a release relies on a group purge for correctness.\nVerification\nInspect the controlled origin response for the intended tag, populate several related cached URLs, and update their revision markers. Purge the tag and verify all affected resources refresh while the unrelated control remains unchanged. Confirm tagging at the origin instead of expecting the stripped header to appear in a public browser response.\nOfficial reference\nCloudflare — Purge cache by cache-tags. Reviewed October 20, 2026.", "content_markdown": "A purge tag works only when cached responses were associated with that tag.\n\n## Source facts\n\nCloudflare documents adding Cache-Tag response headers at the origin so cached content can be invalidated as a group. Several tags can describe one response, allowing a content dependency to span multiple URLs. Cloudflare removes the header before forwarding it to visitors or Workers, so its absence in the visitor response does not show that origin tagging failed.\n\nSource: [Cloudflare — Purge cache by cache-tags](https://developers.cloudflare.com/cache/how-to/purge-cache/purge-by-tags/).\n\n## Applicability\n\nThis concerns Cloudflare tag-based cache invalidation.\n\n## DSE recommendation\n\nDSE recommends designing tags around content dependencies such as a product, section, or shared component rather than opaque deployment accidents. Ensure the origin emits the intended tags on every affected response and keeps their naming stable across releases. Restrict purge credentials and account for the origin traffic needed to refill a large tag group. Keep an untagged control resource in acceptance testing. Ask the content owner to nominate one dependency that spans several URLs, then show where the origin assigns its shared tag. Keep a missing-tag example in the rehearsal to expose incomplete tagging before a release relies on a group purge for correctness.\n\n## Verification\n\nInspect the controlled origin response for the intended tag, populate several related cached URLs, and update their revision markers. Purge the tag and verify all affected resources refresh while the unrelated control remains unchanged. Confirm tagging at the origin instead of expecting the stripped header to appear in a public browser response.\n\n## Official reference\n\n[Cloudflare — Purge cache by cache-tags](https://developers.cloudflare.com/cache/how-to/purge-cache/purge-by-tags/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges/", "url": "https://update.dsesecurity.com/updates/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Emit Cloudflare cache tags from the origin before relying on content-group purges", "item": "https://update.dsesecurity.com/updates/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges/#article", "identifier": "https://update.dsesecurity.com/updates/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges/", "url": "https://update.dsesecurity.com/updates/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges/", "headline": "Emit Cloudflare cache tags from the origin before relying on content-group purges", "description": "A purge tag works only when cached responses were associated with that tag.", "abstract": "A purge tag works only when cached responses were associated with that tag.", "articleBody": "A purge tag works only when cached responses were associated with that tag.\nSource facts\nCloudflare documents adding Cache-Tag response headers at the origin so cached content can be invalidated as a group. Several tags can describe one response, allowing a content dependency to span multiple URLs. Cloudflare removes the header before forwarding it to visitors or Workers, so its absence in the visitor response does not show that origin tagging failed.\nSource: Cloudflare — Purge cache by cache-tags.\nApplicability\nThis concerns Cloudflare tag-based cache invalidation.\nDSE recommendation\nDSE recommends designing tags around content dependencies such as a product, section, or shared component rather than opaque deployment accidents. Ensure the origin emits the intended tags on every affected response and keeps their naming stable across releases. Restrict purge credentials and account for the origin traffic needed to refill a large tag group. Keep an untagged control resource in acceptance testing. Ask the content owner to nominate one dependency that spans several URLs, then show where the origin assigns its shared tag. Keep a missing-tag example in the rehearsal to expose incomplete tagging before a release relies on a group purge for correctness.\nVerification\nInspect the controlled origin response for the intended tag, populate several related cached URLs, and update their revision markers. Purge the tag and verify all affected resources refresh while the unrelated control remains unchanged. Confirm tagging at the origin instead of expecting the stripped header to appear in a public browser response.\nOfficial reference\nCloudflare — Purge cache by cache-tags. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:45+00:00", "dateModified": "2026-10-20T18:34:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/emit-cloudflare-cache-tags-from-the-origin-before-relying-on-content-group-purges/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Emit Cloudflare cache tags from the origin before relying on content-group purges" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 253, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — Purge cache by cache-tags", "url": "https://developers.cloudflare.com/cache/how-to/purge-cache/purge-by-tags/" } } ] } }