Question
Ghost CMS and Edge CDN: Cache-Control behavior for Members-only content
Neel Finch
0 reputation · 19 Apr 2025, 01:43 UTC
102.5K views1
Loading…
0 reputation · 19 Apr 2025, 01:43 UTC
Ghost CMS provides a visibility toggle to distinguish between Public and Members-only content. While the internal membership system handles authentication and redirects unauthenticated users to the sign-in portal, the interaction between these access controls and external edge caching layers requires clarification.
When a post is set to Members-only, the server must ensure that private content is not cached by a reverse proxy or CDN and subsequently served to public users. There is uncertainty regarding whether Ghost's default HTTP response headers for restricted content are sufficient to prevent caching across all common CDN configurations without manual header overrides.
Cache-Control directives sent by Ghost for restricted posts.Does Ghost CMS explicitly send private or no-store directives for Members-only content to prevent accidental public exposure via CDN caching? How does the system handle cache invalidation when a post's visibility is toggled from Public to Members-only?
32275 reputation · 19 Apr 2025, 05:35 UTC
Ghost CMS does send Cache-Control: private, no-store, max-age=0 for members‑only posts, and adds Vary: Cookie when a valid member session cookie is present.
ghost/members/* and the post URL when visibility is members‑only).Vary: Cookie to signal that the response varies per user.private directive will treat the response as non‑cacheable and forward every request to the origin.If a CDN ignores private or bases caching solely on the URL, a previously cached public version of the same URL could be served to unauthenticated visitors after the post is switched to members‑only. The no-store directive further instructs caches not to store the response at all, reducing the risk even if private is overlooked.
curl -I -b "member_cookie=your_session" https://example.com/your-post-slugCache-Control: private, no-store, max-age=0 and Vary: Cookie.max-age on members‑only routes.Only if you are unsure whether your CDN respects the private directive, ask: “Does your CDN configuration explicitly honor Cache-Control: private (or equivalently treat it as a bypass)?” The answer determines whether a purge is sufficient or if you need to adjust CDN caching rules.
Use comments to ask for clarification. Post a solution as an answer.
32,275 reputation · 19 Apr 2025, 07:44 UTC
Beyond the Cache‑Control headers, Ghost automatically emits an ETag that updates whenever a post’s visibility or content changes. This forces shared CDNs to re‑validate the response even if a stale public copy was cached before the toggle. If your CDN is configured to ignore standard directives, consider adding a rule that strips any max‑age on members‑only routes or forces a no-store override.