Cloudflare puts Vary under cache-rule control

Cloudflare has added support for the Vary response header to Cache Rules, the policy layer that decides how its edge treats a cached response. The feature is available on every plan, which matters because Vary is the header most likely to quietly wreck a cache’s hit rate.

Vary tells intermediary caches which request fields may affect the response from an origin. Sites use it to serve different languages, image formats, compression schemes or regional content from a single URL. It stops a cache handing an API client the HTML page it happened to store first, but it says nothing about which differences between two requests actually matter.

Where Vary goes wrong

The failure mode is fragmentation. Ten possible values in one field create ten variants; ten values across three fields can create a thousand combinations. Real request headers carry far more variety than that: user-agent strings are effectively unbounded, cookies can be unique to a visitor, and preference headers differ in ordering, spacing and quality values. The cache stays correct and becomes permanently cold, scattering identical responses across entries that never see enough traffic to stay resident.

Cloudflare measured the problem at scale. Its analysis of more than 120 million responses from nearly 50,000 popular sites found almost 3,000 sites varying on four or more fields, with some varying on 10, 23 or even 47 fields. The company is careful to note that some high-cardinality variation is deliberate, such as a CDN injecting a region to partition content predictably.

What the control actually gives you

With Vary available in Cache Rules, the origin still names the headers that may affect a response, but the site owner decides how Cloudflare handles each one: normalise known negotiation headers, pass exact values through when small differences matter, or bypass the cache when the variation is too unpredictable. It is a middle path between ignoring the header and letting it shred the cache.

Cloudflare’s own engineers have been rude about Vary for years, calling it "the ugliest part of HTTP that we haven’t yet improved", a "horrible, kludgy mechanism" with "pretty abysmal interoperability" between intermediaries. Shipping support means taking a side in a decades-old argument about who is responsible for understanding what a request means.

Our opinion

Vary is the least glamorous thing Cloudflare could have shipped this week, and probably the most useful. Every cache hit that fragmentation destroys is a request that travels back to an origin server somewhere, burning capacity and latency that nobody sees on an invoice. Giving customers a dial between ignoring Vary and obeying it literally is a better answer than the binary the specification offers, even if it does quietly hand the site owner a cache-correctness decision they may not know they are making.

The more interesting number is the 3,000 sites varying on four or more fields. Fragmented caches are usually a symptom of application logic that no one has revisited since it was written, and a dashboard that shows the damage will do more good than the feature that lets you normalise your way out of it.