Cloudflare Adds Configurable HTTP Vary Header Support to Prevent Cache Thrashing

Cloudflare has introduced configurable support for the HTTP Vary response header across its global edge network. This enables customers to prevent "cache thrashing" by allowing origin servers to negotiate different representations of content while providing operators with fine-grained controls. Historically, CDNs have been wary of the Vary header, as slight variations in client headers can result in numerous distinct resource variants.

Cloudflare's solution decouples the negotiation process into two stages: the origin server specifies which request headers affect the response, and Cloudflare's Cache Rules handle how the edge processes those headers before caching. Operators can choose to normalize complex headers, pass them through unchanged, or bypass edge caching altogether for specific fields.

The engine offers three actions: normalise, pass through, and bypass. Normalisation ensures equivalent classes for headers like Accept and Accept-Language, while pass through stores exact strings, and bypass skips edge caching for volatile or high-cardinality headers. When configuring Vary handling, operators can define behaviours per header or apply fallback policies.

Cloudflare records the Vary fields announced by the origin alongside the base cache key, which includes the scheme, host, and path. Subsequent requests are served from the cache if a matching variant is found; otherwise, the request is forwarded to the origin. This two-step architecture resolves the limitations of previous manual workarounds, such as disabling caching or using custom cache keys that anticipate headers before they are seen.

While the new mechanism reduces implementation friction, operators should consider cache key cardinality before enabling full pass-through modes on high-entropy headers, as passing through headers containing arbitrary tokens or session identifiers can reduce cache lifetime and increase eviction churn. The feature is currently active for all Free, Pro, Business, and Enterprise zones.