Symfony HTTP Cache Reverse Proxy Configuration for User‑Specific Content

Answer

Symfony's HttpCache acts as a shared reverse proxy; it obeys Cache-Control and Vary headers from the backend. To prevent user-specific content from being stored in a shared cache while allowing anonymous visitors to benefit from caching, configure conditional headers based on authentication status.

Recommended Header Strategy

• Anonymous users: Cache-Control: public, max-age=60, s-maxage=300
• Authenticated users: Cache-Control: private, no-store, must-revalidate, s-maxage=0

The private directive prevents shared proxies from storing the response, while s-maxage=0 explicitly denies shared caching as a defensive measure. Use no-store for highly sensitive data to prevent browser caching. Always include Vary: Cookie, Authorization on private responses to ensure proper cache key differentiation.

Implementation Steps

1. Create a kernel response event subscriber that runs after security authentication.
2. In the subscriber, check if the user is authenticated via $event->getRequest()->getUser().
3. For anonymous requests, set public caching headers; for authenticated requests, set private, no-store headers with s-maxage=0.
4. Ensure the subscriber runs before HttpCache processes the response for storage decisions.

Verification Methods

Verify the configuration without exposing private data by:

• Using curl -I directly against the backend to confirm header emission.
• Requesting via the reverse proxy with different authenticated sessions and checking that X-Symfony-Cache: MISS appears each time.
• Confirming Vary: Cookie is present on private responses and absent on public ones.
• Inspecting proxy logs or using cache debug headers to verify shared cache behavior.

Key Considerations

private alone is RFC-compliant for preventing shared caching, but combining it with s-maxage=0 is a defensive best practice that explicitly forbids shared storage and is clearer to operators and legacy proxies. The no-store directive is required for highly sensitive data because private still permits browser storage; choose based on your risk tolerance.