HTTP Vary Header
The HTTP Vary response header lists request headers that must participate in the cache key because they change the response body. For APIs, common examples include Accept-Encoding, Accept-Language, and sometimes Authorization when responses are user-specific but still edge-cacheable per user.
Technical Architecture & Deep-Dive
Omitting Vary when content negotiates by header can cause caches to serve the wrong representation, such as gzip to a client that cannot decode it, or English JSON to a French client. Setting Vary too broadly fragments the cache and destroys hit ratio.
Edge gateways should set Vary deliberately on transformed responses, normalize encodings at the edge when possible, and prefer separate URLs or cache keys for major variants instead of listing every custom header. For public JSON, Vary often includes only Accept-Encoding.
Key Architectural Benefits
Vary for Compressed JSON APIs
Vary: Accept-Encoding
Cache-Control: public, max-age=60, s-maxage=300Implement HTTP Vary Header at the Edge
Deploy lightweight API aggregation, edge caching, and secret injection in minutes without Docker containers or complex servers.
Frequently Asked Questions
Q:Should Vary include Authorization?
Only when shared caches store per-user responses and your cache key already isolates users safely. Many personalized APIs should use private or no-store instead.
Related Architecture Concepts
A cache key is the unique identifier a cache uses to store and look up a response. It is typically built from the request URL and may include query parameters, selected headers, or user attributes. Two requests with the same cache key receive the same cached response.
Cache-Control is an HTTP response header that tells browsers, CDNs, and proxies whether and how long a response may be cached. Directives such as max-age, s-maxage, private, no-store, and stale-while-revalidate control freshness and sharing for every cached copy.
HTTP content negotiation is the mechanism by which a client and server agree on the best representation of a resource. Clients send headers such as Accept, Accept-Language, and Accept-Encoding, and the server responds with a matching format, language, or compression.
Brotli is a lossless compression algorithm developed by Google that typically compresses text, HTML, and JSON 15 to 25 percent smaller than gzip. Browsers and HTTP clients advertise support with the Accept-Encoding header, and servers or CDNs return compressed responses.
Ready-to-Use Edge Recipes
To solve rest api edge cdn caching guide, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.
To solve cache dynamic rest api without spinning up redis, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.