# Separate Cloudflare-specific cache policy from browser cache policy

> The most specific CDN header can control Cloudflare while a different header continues downstream.

- Canonical URL: https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:37+00:00
- Modified: 2026-10-20T18:34:36+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

The most specific CDN header can control Cloudflare while a different header continues downstream.

## Potentially affected

This concerns the documented Cloudflare response-header precedence.

## DSE recommendation

DSE recommends assigning an owner to each cache layer and writing the intended browser, Cloudflare, and other-CDN lifetimes separately.

## Article

The most specific CDN header can control Cloudflare while a different header continues downstream.

## Source facts

Cloudflare documents Cloudflare-CDN-Cache-Control as more specific than CDN-Cache-Control when both are present. The Cloudflare-specific header is not forwarded downstream; CDN-Cache-Control can be forwarded for other CDNs. Browser Cache TTL modifies Cache-Control rather than these CDN headers, while Edge Cache TTL can override their edge lifetime. Cache Response Rules can introduce an additional higher-precedence directive layer.

Source: [Cloudflare — CDN-Cache-Control](https://developers.cloudflare.com/cache/concepts/cdn-cache-control/).

## Applicability

This concerns the documented Cloudflare response-header precedence.

## DSE recommendation

DSE recommends assigning an owner to each cache layer and writing the intended browser, Cloudflare, and other-CDN lifetimes separately. Prefer explicit headers over unexplained overlapping rules. Inventory any response rules and edge TTL overrides before attributing observed behavior to the origin. Keep sensitive responses out of shared caching regardless of a performance-driven lifetime difference. Use a layer-by-layer policy table with a row for each header producer and override. Ask a reviewer to predict the delivered browser header and the edge freshness interval from that table, then compare both predictions with the same controlled resource before accepting the configuration.

## Verification

Inspect the origin response and the response delivered through Cloudflare for a controlled test asset. Confirm which headers are retained downstream and measure revalidation at the intended layers. Compare the effective edge lifetime with matching rules, then test a browser reload independently instead of assuming an edge purge also changes a previously cached browser response.

## Official reference

[Cloudflare — CDN-Cache-Control](https://developers.cloudflare.com/cache/concepts/cdn-cache-control/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — CDN-Cache-Control
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/cache/concepts/cdn-cache-control/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate Cloudflare-specific cache policy from browser cache policy,” DSE Security, https://update.dsesecurity.com/updates/separate-cloudflare-specific-cache-policy-from-browser-cache-policy/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.