Cache Policy Mechanics
A cache policy controls what CloudFront uses to calculate the cache key. When a viewer makes a request, CloudFront checks if the requested URL matches an existing cache entry along with any headers, cookies, or query strings designated in the cache policy. If you include a header like Authorization, CloudFront creates a distinct cached object for every unique token or user to prevent data leaks. It also defines how long assets remain cached via minimum, maximum, and default TTLs.
Origin Request Policy Mechanics
An origin request policy decouples data forwarding from caching. It tells CloudFront: "Pass these specific headers, cookies, or query strings down to my EC2 instance or S3 bucket, but do not include them in the cache key." This is ideal for performance optimization when you want all users to share a single cached response (maximizing cache hits), while still providing your backend application with operational telemetry or client context it needs to execute the request.
Why Authorization Demands a Cache Policy
Because an Authorization header carries private user credentials, session tokens, or API keys, reusing a cached response across multiple users would cause a major security violation. Forcing Authorization into a Cache Policy ensures that CloudFront treats authenticated responses as strictly user-specific, isolating cached payloads safely.
Top comments (0)