November Happy Hour will be moved to Thursday December 5th.

Output cache storing responses for authenticated users

Vote:
 

We seem to be getting output cache with copies of output from authenticated users (epi editors & admins).

If an authenticated user loaded the page first, it results in public visitors seeing a cached copy of content that has the top-right epi tab.. I've tested this and it is repeatable.

From what I understand the output cache should not store output for authenticated requests.

We haven’t done anything custom with output cache and have simply configured our episerver section like this:







Also, if it helps, here are our CMS packages we’re using:









Any ideas why this might be happening?

#172036
Nov 24, 2016 6:29
Vote:
 

Okay, so I should have mentioned we are hosted in DXC which means it has the Cloudflare CDN.

I think the issue was not the output cache, and rather the client cache response header values for pages. I had it set to one hour using the following code:

var timespanExpiry = new TimeSpan(1, 0, 0);
HttpContext.Current.Response.Cache.SetCacheability(HttpCacheability.Public);
HttpContext.Current.Response.Cache.SetMaxAge(timespanExpiry); // One hour
HttpContext.Current.Response.Cache.SetExpires(DateTime.Now.Add(timespanExpiry)); // One hour

But I think the issue was because I had cache set to "Public", the CDN was storing a copy of it - which when was an authenticated user would have the epi tab. I have changed it to:

HttpContext.Current.Response.Cache.SetCacheability(HttpCacheability.Private);

And so far the issue has not repeated.

#172162
Nov 24, 2016 23:23
Vote:
 

Puh! You got me worried there for a while :)

Nice to hear it's working as intended again. It would have been a bad ass bug otherwise! 

Thx for getting back on this one...

#172169
Nov 25, 2016 9:37
This topic was created over six months ago and has been resolved. If you have a similar question, please create a new topic and refer to this one.
* You are NOT allowed to include any hyperlinks in the post because your account hasn't associated to your company. User profile should be updated.