# Keep Cloudflare custom cache keys aligned with the URL sent to the origin

> Consolidating keys can be unsafe when the origin still distinguishes the requests.

- Canonical URL: https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:41+00:00
- Modified: 2026-10-20T18:34:36+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Consolidating keys can be unsafe when the origin still distinguishes the requests.

## Potentially affected

This concerns Cloudflare request-derived custom cache keys.

## DSE recommendation

DSE recommends listing every input that changes response content before removing it from the key.

## Article

Consolidating keys can be unsafe when the origin still distinguishes the requests.

## Source facts

Cloudflare describes cache keys as identifiers derived from request properties. Custom keys can split one URL into variants or consolidate different requests, but may reduce hit rate through sharding. The source recommends enabling Normalize URLs to origin alongside URL normalization for custom-key designs so the keyed URL matches what the origin receives.

Source: [Cloudflare — Cache Keys](https://developers.cloudflare.com/cache/how-to/cache-keys/).

## Applicability

This concerns Cloudflare request-derived custom cache keys.

## DSE recommendation

DSE recommends listing every input that changes response content before removing it from the key. Keep personalization and authorization dimensions out of a public shared-cache design unless there is an explicitly reviewed architecture. Prefer a small meaningful key rather than including arbitrary high-cardinality headers. Review origin normalization and any rewritten paths together so two requests merged at the cache do not still produce different origin output. Create an equivalence table showing which pairs of requests may share output and which must remain separate. For each omitted dimension, require the application owner’s reason. Include the post-normalization origin URL in that table so the safety decision covers the request actually processed by the application.

## Verification

In a controlled environment, compare requests intended to share content and requests intended to remain distinct. Inspect the final origin URL, content marker, and repeated-request cache behavior. Confirm the design cannot return one variant for another request and document the expected purge method for the chosen key dimensions.

## Official reference

[Cloudflare — Cache Keys](https://developers.cloudflare.com/cache/how-to/cache-keys/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — Cache Keys
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/cache/how-to/cache-keys/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep Cloudflare custom cache keys aligned with the URL sent to the origin,” DSE Security, https://update.dsesecurity.com/updates/keep-cloudflare-custom-cache-keys-aligned-with-the-url-sent-to-the-origin/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.