{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/", "item": { "id": "https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/", "slug": "separate-cloudflare-specific-cache-policy-from-browser-cache-policy", "url": "https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy.md", "json": "https://update.dsesecurity.com/api/v1/posts/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/" }, "title": "Separate Cloudflare-specific cache policy from browser cache policy", "summary": "The most specific CDN header can control Cloudflare while a different header continues downstream.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:37+00:00", "modified_at": "2026-10-20T18:34:36+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 244, "potentially_affected": "This concerns the documented Cloudflare response-header precedence.", "dse_recommendation": "DSE recommends assigning an owner to each cache layer and writing the intended browser, Cloudflare, and other-CDN lifetimes separately.", "primary_source": { "name": "Cloudflare — CDN-Cache-Control", "url": "https://developers.cloudflare.com/cache/concepts/cdn-cache-control/", "published_on": null, "authority": "developers.cloudflare.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

The most specific CDN header can control Cloudflare while a different header continues downstream.

\n

Source facts

\n

Cloudflare documents Cloudflare-CDN-Cache-Control as more specific than CDN-Cache-Control when both are present. The Cloudflare-specific header is not forwarded downstream; CDN-Cache-Control can be forwarded for other CDNs. Browser Cache TTL modifies Cache-Control rather than these CDN headers, while Edge Cache TTL can override their edge lifetime. Cache Response Rules can introduce an additional higher-precedence directive layer.

\n

Source: Cloudflare — CDN-Cache-Control.

\n

Applicability

\n

This concerns the documented Cloudflare response-header precedence.

\n

DSE recommendation

\n

DSE recommends assigning an owner to each cache layer and writing the intended browser, Cloudflare, and other-CDN lifetimes separately. Prefer explicit headers over unexplained overlapping rules. Inventory any response rules and edge TTL overrides before attributing observed behavior to the origin. Keep sensitive responses out of shared caching regardless of a performance-driven lifetime difference. Use a layer-by-layer policy table with a row for each header producer and override. Ask a reviewer to predict the delivered browser header and the edge freshness interval from that table, then compare both predictions with the same controlled resource before accepting the configuration.

\n

Verification

\n

Inspect the origin response and the response delivered through Cloudflare for a controlled test asset. Confirm which headers are retained downstream and measure revalidation at the intended layers. Compare the effective edge lifetime with matching rules, then test a browser reload independently instead of assuming an edge purge also changes a previously cached browser response.

\n

Official reference

\n

Cloudflare — CDN-Cache-Control. Reviewed October 20, 2026.

", "content_text": "The most specific CDN header can control Cloudflare while a different header continues downstream.\nSource facts\nCloudflare documents Cloudflare-CDN-Cache-Control as more specific than CDN-Cache-Control when both are present. The Cloudflare-specific header is not forwarded downstream; CDN-Cache-Control can be forwarded for other CDNs. Browser Cache TTL modifies Cache-Control rather than these CDN headers, while Edge Cache TTL can override their edge lifetime. Cache Response Rules can introduce an additional higher-precedence directive layer.\nSource: Cloudflare — CDN-Cache-Control.\nApplicability\nThis concerns the documented Cloudflare response-header precedence.\nDSE recommendation\nDSE recommends assigning an owner to each cache layer and writing the intended browser, Cloudflare, and other-CDN lifetimes separately. Prefer explicit headers over unexplained overlapping rules. Inventory any response rules and edge TTL overrides before attributing observed behavior to the origin. Keep sensitive responses out of shared caching regardless of a performance-driven lifetime difference. Use a layer-by-layer policy table with a row for each header producer and override. Ask a reviewer to predict the delivered browser header and the edge freshness interval from that table, then compare both predictions with the same controlled resource before accepting the configuration.\nVerification\nInspect the origin response and the response delivered through Cloudflare for a controlled test asset. Confirm which headers are retained downstream and measure revalidation at the intended layers. Compare the effective edge lifetime with matching rules, then test a browser reload independently instead of assuming an edge purge also changes a previously cached browser response.\nOfficial reference\nCloudflare — CDN-Cache-Control. Reviewed October 20, 2026.", "content_markdown": "The most specific CDN header can control Cloudflare while a different header continues downstream.\n\n## Source facts\n\nCloudflare documents Cloudflare-CDN-Cache-Control as more specific than CDN-Cache-Control when both are present. The Cloudflare-specific header is not forwarded downstream; CDN-Cache-Control can be forwarded for other CDNs. Browser Cache TTL modifies Cache-Control rather than these CDN headers, while Edge Cache TTL can override their edge lifetime. Cache Response Rules can introduce an additional higher-precedence directive layer.\n\nSource: [Cloudflare — CDN-Cache-Control](https://developers.cloudflare.com/cache/concepts/cdn-cache-control/).\n\n## Applicability\n\nThis concerns the documented Cloudflare response-header precedence.\n\n## DSE recommendation\n\nDSE recommends assigning an owner to each cache layer and writing the intended browser, Cloudflare, and other-CDN lifetimes separately. Prefer explicit headers over unexplained overlapping rules. Inventory any response rules and edge TTL overrides before attributing observed behavior to the origin. Keep sensitive responses out of shared caching regardless of a performance-driven lifetime difference. Use a layer-by-layer policy table with a row for each header producer and override. Ask a reviewer to predict the delivered browser header and the edge freshness interval from that table, then compare both predictions with the same controlled resource before accepting the configuration.\n\n## Verification\n\nInspect the origin response and the response delivered through Cloudflare for a controlled test asset. Confirm which headers are retained downstream and measure revalidation at the intended layers. Compare the effective edge lifetime with matching rules, then test a browser reload independently instead of assuming an edge purge also changes a previously cached browser response.\n\n## Official reference\n\n[Cloudflare — CDN-Cache-Control](https://developers.cloudflare.com/cache/concepts/cdn-cache-control/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/", "url": "https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Separate Cloudflare-specific cache policy from browser cache policy", "item": "https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/#article", "identifier": "https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/", "url": "https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/", "headline": "Separate Cloudflare-specific cache policy from browser cache policy", "description": "The most specific CDN header can control Cloudflare while a different header continues downstream.", "abstract": "The most specific CDN header can control Cloudflare while a different header continues downstream.", "articleBody": "The most specific CDN header can control Cloudflare while a different header continues downstream.\nSource facts\nCloudflare documents Cloudflare-CDN-Cache-Control as more specific than CDN-Cache-Control when both are present. The Cloudflare-specific header is not forwarded downstream; CDN-Cache-Control can be forwarded for other CDNs. Browser Cache TTL modifies Cache-Control rather than these CDN headers, while Edge Cache TTL can override their edge lifetime. Cache Response Rules can introduce an additional higher-precedence directive layer.\nSource: Cloudflare — CDN-Cache-Control.\nApplicability\nThis concerns the documented Cloudflare response-header precedence.\nDSE recommendation\nDSE recommends assigning an owner to each cache layer and writing the intended browser, Cloudflare, and other-CDN lifetimes separately. Prefer explicit headers over unexplained overlapping rules. Inventory any response rules and edge TTL overrides before attributing observed behavior to the origin. Keep sensitive responses out of shared caching regardless of a performance-driven lifetime difference. Use a layer-by-layer policy table with a row for each header producer and override. Ask a reviewer to predict the delivered browser header and the edge freshness interval from that table, then compare both predictions with the same controlled resource before accepting the configuration.\nVerification\nInspect the origin response and the response delivered through Cloudflare for a controlled test asset. Confirm which headers are retained downstream and measure revalidation at the intended layers. Compare the effective edge lifetime with matching rules, then test a browser reload independently instead of assuming an edge purge also changes a previously cached browser response.\nOfficial reference\nCloudflare — CDN-Cache-Control. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:37+00:00", "dateModified": "2026-10-20T18:34:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate Cloudflare-specific cache policy from browser cache policy" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 244, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — CDN-Cache-Control", "url": "https://developers.cloudflare.com/cache/concepts/cdn-cache-control/" } } ] } }