- User visits subdomain1.mydomain.com, which sends back cache-control (
public, max-age=86400) instructions in its response, which means the CDN and browser cache it. These instructions are only sent for logged-out visitors. - User visits subdomain2.mydomain.com, and logs in. The login cookie is an http-only mydomain.com cookie, valid for both subdomains.
- User navigates back to subdomain1.mydomain.com to visit the previously visited page, and unfortunately gets the logged-out version of the page since it is browser-cached.
What's the cleanest way to have #3 skip the browser cache? This is also an issue when someone clicks the back button (from subdomain2 to subdomain1). The cookie is http-only so we can't have client-side javascript check for the presence of the cookie.
We also need that cache-control instruction (or something like it) for the CDN (Akamai). We could possibly then have Akamai send altered cache-control instructions to the browser, maybe no-cache?
I've also heard about Vary: cookie but I mostly see warnings not to use it.
It's as if I want the browser to serve from browser cache unless a certain cookie exists.