React memory
TanStack Query cache
browser HTTP cache
back/forward cache
service worker cache
IndexedDB
localStorage/sessionStorage
CDN/shared proxy cache
server-side render cache
edge cache
logs/analytics/session replay tools

user logs out
session expires
user switches tenant
role is revoked
object ACL changes
case moves to restricted state
user presses browser back
another user uses the same machine
CDN reuses the response
service worker serves stale data

cache public immutable assets aggressively
cache authenticated/sensitive responses conservatively
scope client caches by auth context
never put personalized responses in shared caches accidentally
clear or invalidate auth-scoped caches on logout/tenant/permission changes

Cache-Control: no-store

/session
/me
/permissions
case details
sensitive search results
generated exports
auth callback responses
logout responses
session/token-bearing responses

Cache-Control: private, max-age=60

Cache-Control: private, no-cache

Cache-Control: private, max-age=30

Cache-Control: private, max-age=0, must-revalidate

HTTP/1.1 200 OK
Content-Type: application/json

{"caseId":"case_123","subject":"..."}

Cache-Control: public, max-age=300

Cache-Control: no-cache

Cache-Control: no-store
Pragma: no-cache
Expires: 0
Vary: Authorization, Cookie

Cache-Control: no-store
Vary: Cookie, Authorization

GET /api/session
GET /api/me
GET /api/permissions

Cache-Control: private, no-cache, must-revalidate
Vary: Cookie, Authorization

Cache-Control: public, max-age=31536000, immutable

Cache-Control: no-store
Clear-Site-Data: "cache", "storage"

import type { Request, Response, NextFunction } from 'express';

export function noStore(_req: Request, res: Response, next: NextFunction) {
  res.setHeader('Cache-Control', 'no-store');
  res.setHeader('Pragma', 'no-cache');
  res.setHeader('Expires', '0');
  next();
}

export function varyAuth(_req: Request, res: Response, next: NextFunction) {
  res.vary('Cookie');
  res.vary('Authorization');
  next();
}

app.use('/api/session', noStore, varyAuth);
app.use('/api/me', noStore, varyAuth);
app.use('/api/permissions', noStore, varyAuth);
app.use('/api/cases', noStore, varyAuth);
app.use('/api/exports', noStore, varyAuth);

app.get('/bff/session', noStore, async (req, res) => {
  const session = await requireSession(req);
  res.json(projectSession(session));
});

Never cache personalized responses as public.
Never rely on cookies alone to prevent CDN caching.
Ensure CDN cache key includes required variation dimensions.
Prefer no-store/private for authenticated API responses.
Separate public asset paths from authenticated API/page paths.

GET /dashboard with Cookie user=A -> CDN caches HTML
GET /dashboard with Cookie user=B -> CDN serves user A dashboard

Cache-Control: private, no-store
Vary: Cookie

Vary: Authorization, Cookie

Cache-Control: no-store
Vary: Authorization, Cookie

authEvents.subscribe((event) => {
  if (event.type === 'LOGOUT') {
    queryClient.clear();
  }

  if (event.type === 'TENANT_SWITCH') {
    queryClient.removeQueries({
      predicate: (query) => query.queryKey.includes(event.fromTenantId),
    });
  }

  if (event.type === 'PERMISSIONS_CHANGED') {
    queryClient.invalidateQueries();
  }
});

const queryKey = [
  'tenant', auth.tenantId,
  'authEpoch', auth.authEpoch,
  'permissionVersion', auth.permissionVersion,
  'case', caseId,
];

['case', caseId]

[
  'user', auth.userId,
  'tenant', auth.tenantId,
  'authEpoch', auth.authEpoch,
  'permissionVersion', auth.permissionVersion,
  'case', caseId,
]

If changing X can change whether cached data is valid or visible, X belongs in cache scope or invalidation triggers.

async function clientLogoutCleanup() {
  pollingRegistry.stopAll('logout');
  realtimeRegistry.closeAll('logout');
  uploadRegistry.abortAll('logout');

  queryClient.clear();
  sessionStorage.clear();

  await clearServiceWorkerSensitiveCaches();
  toast.dismiss();

  authStore.resetToAnonymous();
}

async function clearServiceWorkerSensitiveCaches() {
  if (!('caches' in window)) return;

  const names = await caches.keys();
  await Promise.all(
    names
      .filter((name) => name.startsWith('auth-data-'))
      .map((name) => caches.delete(name))
  );
}

POST /logout
Cache-Control: no-store
Clear-Site-Data: "cache", "storage"
Set-Cookie: __Host-session=; Max-Age=0; Path=/; Secure; HttpOnly; SameSite=Lax

user views sensitive case page
user logs out
user presses browser back
browser restores previous page from memory snapshot

window.addEventListener('pageshow', (event) => {
  if (event.persisted) {
    authStore.revalidateSession({ reason: 'bfcache_restore' });
  }
});

authStore.resetToAnonymous();
queryClient.clear();
router.navigate('/login', { replace: true });

self.addEventListener('fetch', (event) => {
  event.respondWith(
    caches.match(event.request).then((cached) => cached || fetch(event.request))
  );
});

const PUBLIC_ASSET_PREFIXES = ['/assets/', '/static/', '/favicon'];

self.addEventListener('fetch', (event) => {
  const url = new URL(event.request.url);

  const isPublicAsset = PUBLIC_ASSET_PREFIXES.some((prefix) =>
    url.pathname.startsWith(prefix)
  );

  if (!isPublicAsset) {
    event.respondWith(fetch(event.request));
    return;
  }

  // Cache public assets only.
});

Do not persist tokens in localStorage.
Do not persist sensitive user data unless offline use case truly requires it.
Scope persisted data by user/tenant/session.
Clear persisted auth data on logout.
Expire persisted data.
Revalidate before using persisted data after app start.
Never use persisted data as authorization authority.

HTML with user data
serialized loader data
RSC payload
hydration script
preloaded JSON
error details

Cache-Control: no-store
Vary: Cookie

export async function loader({ request, params }: LoaderArgs) {
  const session = await requireSession(request);
  const data = await loadCaseForUser(session, params.caseId);

  return json(data, {
    headers: {
      'Cache-Control': 'no-store',
      Vary: 'Cookie',
    },
  });
}

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
Vary: Cookie, Authorization

{
  "status": "authenticated",
  "userId": "usr_123",
  "tenantId": "ten_456",
  "authEpoch": 42
}

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
Vary: Cookie, Authorization

{
  "permissionVersion": "perm_9f2",
  "allowedActions": ["case.read", "case.comment"]
}

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: public, max-age=300

HTTP/1.1 200 OK
Content-Type: application/javascript
Cache-Control: public, max-age=31536000, immutable

short-lived signed URLs
authorization check before issuing URL
authorization check before serving if proxied
Cache-Control: no-store for sensitive downloads
safe Content-Disposition filename
audit download events
result expiry and revocation

HTTP/1.1 200 OK
Content-Type: text/csv
Content-Disposition: attachment; filename="export.csv"
Cache-Control: no-store
X-Content-Type-Options: nosniff

high-risk-sanctions-investigation-tenant-a.csv

Cache-Control: no-store

global stores
query cache
context providers
error boundaries
form state
toast payloads
modal state
recently viewed lists

toast.success(`Export for ${caseName} is ready`);

function showAuthScopedToast(message: string, context: AuthContext) {
  const latest = authStore.snapshot();
  if (latest.authEpoch !== context.authEpoch) return;
  if (latest.tenantId !== context.tenantId) return;
  toast.success(message);
}

toast.dismiss();

URLs
page titles
DOM text
button labels
form values
error messages
network metadata

mask sensitive DOM
avoid sensitive data in URLs
sanitize error messages
configure session replay redaction
avoid sending permission details as analytics properties unless approved

/app/cases?personName=Jane+Doe&ssn=...

browser history
server logs
proxy logs
analytics
Referer headers
screenshots
support tickets

ETag: "case-123-v7"
Cache-Control: public, max-age=60

Cache-Control: private, no-cache
ETag: "opaque-user-scoped-etag"
Vary: Cookie, Authorization

localStorage.setItem('permissions', JSON.stringify(permissions));

permissions become stale after role/ACL change
permissions are script-readable
permissions may persist across users
permissions may be treated as authority by mistake

type PermissionSnapshot = {
  userId: string;
  tenantId: string;
  permissionVersion: string;
  generatedAt: string;
  allowedActions: string[];
};

logout
login as different user
tenant switch
role/ACL change
policy version change
403 stale-permission response
impersonation start/end

browser -> BFF -> resource API

app.get('/bff/cases/:caseId', requireSession, async (req, res) => {
  const result = await caseService.getCaseForViewer(req.session, req.params.caseId);

  res.setHeader('Cache-Control', 'no-store');
  res.setHeader('Vary', 'Cookie');
  res.json(result);
});

Any render path that depends on cookies/session/user/tenant/permission must be dynamic/private and must not be globally cached.

await fetch('https://api.example.com/cases/123', {
  cache: 'no-store',
  headers: { Cookie: request.headers.get('cookie') ?? '' },
});

await fetch('https://api.example.com/public/config', {
  next: { revalidate: 300 },
});

Clear-Site-Data: "cache", "storage"

Clear-Site-Data: "cookies"

logout cleanup
account switch cleanup
incident response after cache leak
reset corrupted offline data

origin-scoped
may clear unrelated app data on same origin
not a replacement for server-side session revocation
cookie clearing depends on cookie domain/path design

server revokes session
server expires auth cookie
server sends Clear-Site-Data if appropriate
client clears in-memory/query/service-worker caches

type CacheSensitivity =
  | 'public_asset'
  | 'public_data'
  | 'private_low'
  | 'private_sensitive'
  | 'auth_projection'
  | 'download_sensitive';

type CachePolicy = {
  cacheControl: string;
  vary?: string[];
};

const cachePolicies: Record<CacheSensitivity, CachePolicy> = {
  public_asset: { cacheControl: 'public, max-age=31536000, immutable' },
  public_data: { cacheControl: 'public, max-age=300' },
  private_low: {
    cacheControl: 'private, no-cache, must-revalidate',
    vary: ['Cookie', 'Authorization'],
  },
  private_sensitive: {
    cacheControl: 'no-store',
    vary: ['Cookie', 'Authorization'],
  },
  auth_projection: {
    cacheControl: 'no-store',
    vary: ['Cookie', 'Authorization'],
  },
  download_sensitive: {
    cacheControl: 'no-store',
    vary: ['Cookie', 'Authorization'],
  },
};

function applyCachePolicy(res: ResponseLike, sensitivity: CacheSensitivity) {
  const policy = cachePolicies[sensitivity];

  res.setHeader('Cache-Control', policy.cacheControl);

  for (const vary of policy.vary ?? []) {
    res.vary?.(vary);
  }
}

it('marks session projection as no-store', async () => {
  const response = await request(app)
    .get('/api/session')
    .set('Cookie', validSessionCookie);

  expect(response.headers['cache-control']).toContain('no-store');
  expect(response.headers['vary']).toMatch(/Cookie|Authorization/);
});

it('clears query cache on logout', () => {
  queryClient.setQueryData(['tenant', 'A', 'case', '1'], { title: 'Secret' });

  authEvents.emit({ type: 'LOGOUT', authEpoch: 11, reason: 'manual' });

  expect(queryClient.getQueryCache().findAll()).toHaveLength(0);
});

purge CDN cache
change origin headers to no-store/private
add CDN bypass rule for authenticated paths
review logs for affected users
notify according to policy
add regression header tests

origin sent public cache headers?
CDN ignored origin headers?
route misclassified as public?
Vary missing?
SSR framework statically rendered private page?

clear in-memory cache on logout
add pageshow persisted revalidation
send no-store for sensitive pages
ensure logout clears app state before navigation

remove private routes from SW cache
ship SW cache purge
send Clear-Site-Data if appropriate
version service worker cache names
use allowlist-only caching

disable persistence for sensitive queries
scope persisted cache by user/tenant/session
clear storage on logout/account switch
force rebootstrap on app start

Every cached value must have an owner, scope, lifetime, invalidation trigger, and sensitivity classification.

Who is allowed to see it?
Which tenant/resource does it belong to?
How long is it valid?
What event invalidates it?
Where can a copy survive logout?