Bypass cache for logged-in users

[MateuszNo2]

We’re running AEM as a Cloud Service with the default Dispatcher setup. For anonymous users, caching works fine. But for logged-in users (after SSO), we don’t want certain pages (like /content/myapp/us/en/dashboard.html) to be cached at all - they should always be fresh from Publish.

I tried adding rules like this in dispatcher:
/0018 {
/type "allow"
/glob "/content/myapp/us/en/dashboard.html"
/headers {
"Cache-Control" "no-store"
}
}

but when I test the page is being cached by Dispatcher

[SantoshSai · Accepted solution]

Hi @MateuszNo2,

Try this: 

cache.any

/cache {
  /allowAuthorized "0"           # if request has Authorization, don't cache
  /rules {
    /0010 { /glob "/content/myapp/us/en/dashboard.html*" /type "deny" }  # never cache this path
  }
}

clientheaders.any

Authorization
Cookie

(Forward these so Publish can personalize; Authorization lets /allowAuthorized "0" work.)

Then flush the existing file from the cache (or delete the cached .html under the dispatcher cache root) and retest.

[giuseppebag]

Additionally, to prevent a page from being cached in the CDN, you should set specific response headers:

Header	Purpose
Cache-Control: no-cache	Cache must check with server before using a cached response
Cache-Control: no-store	Cache must not store this response
Cache-Control: must-revalidate	Once cached response is stale, must revalidate before serving
Pragma: no-cache	HTTP 1.0 backward-compatible no-caching directive
Expires: 0	Response is immediately expired; do not serve from cache