{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/", "item": { "id": "https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/", "slug": "keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin", "url": "https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin.md", "json": "https://update.dsesecurity.com/api/v1/posts/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/" }, "title": "Keep Cloudflare custom cache keys aligned with the URL sent to the origin", "summary": "Consolidating keys can be unsafe when the origin still distinguishes the requests.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:41+00:00", "modified_at": "2026-10-20T18:34:36+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 248, "potentially_affected": "This concerns Cloudflare request-derived custom cache keys.", "dse_recommendation": "DSE recommends listing every input that changes response content before removing it from the key.", "primary_source": { "name": "Cloudflare — Cache Keys", "url": "https://developers.cloudflare.com/cache/how-to/cache-keys/", "published_on": null, "authority": "developers.cloudflare.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Consolidating keys can be unsafe when the origin still distinguishes the requests.

\n

Source facts

\n

Cloudflare describes cache keys as identifiers derived from request properties. Custom keys can split one URL into variants or consolidate different requests, but may reduce hit rate through sharding. The source recommends enabling Normalize URLs to origin alongside URL normalization for custom-key designs so the keyed URL matches what the origin receives.

\n

Source: Cloudflare — Cache Keys.

\n

Applicability

\n

This concerns Cloudflare request-derived custom cache keys.

\n

DSE recommendation

\n

DSE recommends listing every input that changes response content before removing it from the key. Keep personalization and authorization dimensions out of a public shared-cache design unless there is an explicitly reviewed architecture. Prefer a small meaningful key rather than including arbitrary high-cardinality headers. Review origin normalization and any rewritten paths together so two requests merged at the cache do not still produce different origin output. Create an equivalence table showing which pairs of requests may share output and which must remain separate. For each omitted dimension, require the application owner’s reason. Include the post-normalization origin URL in that table so the safety decision covers the request actually processed by the application.

\n

Verification

\n

In a controlled environment, compare requests intended to share content and requests intended to remain distinct. Inspect the final origin URL, content marker, and repeated-request cache behavior. Confirm the design cannot return one variant for another request and document the expected purge method for the chosen key dimensions.

\n

Official reference

\n

Cloudflare — Cache Keys. Reviewed October 20, 2026.

", "content_text": "Consolidating keys can be unsafe when the origin still distinguishes the requests.\nSource facts\nCloudflare describes cache keys as identifiers derived from request properties. Custom keys can split one URL into variants or consolidate different requests, but may reduce hit rate through sharding. The source recommends enabling Normalize URLs to origin alongside URL normalization for custom-key designs so the keyed URL matches what the origin receives.\nSource: Cloudflare — Cache Keys.\nApplicability\nThis concerns Cloudflare request-derived custom cache keys.\nDSE recommendation\nDSE recommends listing every input that changes response content before removing it from the key. Keep personalization and authorization dimensions out of a public shared-cache design unless there is an explicitly reviewed architecture. Prefer a small meaningful key rather than including arbitrary high-cardinality headers. Review origin normalization and any rewritten paths together so two requests merged at the cache do not still produce different origin output. Create an equivalence table showing which pairs of requests may share output and which must remain separate. For each omitted dimension, require the application owner’s reason. Include the post-normalization origin URL in that table so the safety decision covers the request actually processed by the application.\nVerification\nIn a controlled environment, compare requests intended to share content and requests intended to remain distinct. Inspect the final origin URL, content marker, and repeated-request cache behavior. Confirm the design cannot return one variant for another request and document the expected purge method for the chosen key dimensions.\nOfficial reference\nCloudflare — Cache Keys. Reviewed October 20, 2026.", "content_markdown": "Consolidating keys can be unsafe when the origin still distinguishes the requests.\n\n## Source facts\n\nCloudflare describes cache keys as identifiers derived from request properties. Custom keys can split one URL into variants or consolidate different requests, but may reduce hit rate through sharding. The source recommends enabling Normalize URLs to origin alongside URL normalization for custom-key designs so the keyed URL matches what the origin receives.\n\nSource: [Cloudflare — Cache Keys](https://developers.cloudflare.com/cache/how-to/cache-keys/).\n\n## Applicability\n\nThis concerns Cloudflare request-derived custom cache keys.\n\n## DSE recommendation\n\nDSE recommends listing every input that changes response content before removing it from the key. Keep personalization and authorization dimensions out of a public shared-cache design unless there is an explicitly reviewed architecture. Prefer a small meaningful key rather than including arbitrary high-cardinality headers. Review origin normalization and any rewritten paths together so two requests merged at the cache do not still produce different origin output. Create an equivalence table showing which pairs of requests may share output and which must remain separate. For each omitted dimension, require the application owner’s reason. Include the post-normalization origin URL in that table so the safety decision covers the request actually processed by the application.\n\n## Verification\n\nIn a controlled environment, compare requests intended to share content and requests intended to remain distinct. Inspect the final origin URL, content marker, and repeated-request cache behavior. Confirm the design cannot return one variant for another request and document the expected purge method for the chosen key dimensions.\n\n## Official reference\n\n[Cloudflare — Cache Keys](https://developers.cloudflare.com/cache/how-to/cache-keys/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/", "url": "https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Keep Cloudflare custom cache keys aligned with the URL sent to the origin", "item": "https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/#article", "identifier": "https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/", "url": "https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/", "headline": "Keep Cloudflare custom cache keys aligned with the URL sent to the origin", "description": "Consolidating keys can be unsafe when the origin still distinguishes the requests.", "abstract": "Consolidating keys can be unsafe when the origin still distinguishes the requests.", "articleBody": "Consolidating keys can be unsafe when the origin still distinguishes the requests.\nSource facts\nCloudflare describes cache keys as identifiers derived from request properties. Custom keys can split one URL into variants or consolidate different requests, but may reduce hit rate through sharding. The source recommends enabling Normalize URLs to origin alongside URL normalization for custom-key designs so the keyed URL matches what the origin receives.\nSource: Cloudflare — Cache Keys.\nApplicability\nThis concerns Cloudflare request-derived custom cache keys.\nDSE recommendation\nDSE recommends listing every input that changes response content before removing it from the key. Keep personalization and authorization dimensions out of a public shared-cache design unless there is an explicitly reviewed architecture. Prefer a small meaningful key rather than including arbitrary high-cardinality headers. Review origin normalization and any rewritten paths together so two requests merged at the cache do not still produce different origin output. Create an equivalence table showing which pairs of requests may share output and which must remain separate. For each omitted dimension, require the application owner’s reason. Include the post-normalization origin URL in that table so the safety decision covers the request actually processed by the application.\nVerification\nIn a controlled environment, compare requests intended to share content and requests intended to remain distinct. Inspect the final origin URL, content marker, and repeated-request cache behavior. Confirm the design cannot return one variant for another request and document the expected purge method for the chosen key dimensions.\nOfficial reference\nCloudflare — Cache Keys. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:41+00:00", "dateModified": "2026-10-20T18:34:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep Cloudflare custom cache keys aligned with the URL sent to the origin" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 248, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — Cache Keys", "url": "https://developers.cloudflare.com/cache/how-to/cache-keys/" } } ] } }