This question is about PGID-handling.
Here is the scenario:
I have multiple applications (account, helpdesk, login). Imagine an HTTP server playing a proxy role to make them available within the same domain www.example.com with different paths. Some pages need a logged-in user, and we want to use an external OAuth2-service to allow all the fancy login methods like Google, GitHub & Co.
For this, imagine a dedicated application which uses routes like /login /logout to connect to this external login service. As a result, it would place a (http only secure) cookie containing a JWT which describes the current user.
This JWT will be validated by each service which requires a login and removes the need for dedicated logins. Valid JWT => valid login. So far, so good. This already works.
But there is this tiny thing called Page Cache. We use personalized caching, so we cache based on URL and PGID (red boxes in the picture, content depends on user group). If we log in/log out using the Login-Service, I prefer not to show the wrong content in the ISH-service later on.
And here comes the question:
How can I mark a PGID as invalid, so the webadapter requests a new PGID from the application server (which can take my JWT into account) before grabbing a page from the page cache?