Ability to disable half measure / app static caching on protected pages

[jasonvarga]

See statamic/cms#1858

If a page is protected and you're logged out, you should not see the cached version.

Right now, the cached version may be either the logged out render or the logged in render, depending on who hits the page first. This isn't ideal.

You can disable caching for that URL to get around it, but if you're doing sitewide protection then you're effectively disabling static caching entirely.

[jacksleight]

I’ve been working on a site where this came up and have been playing around with a potential solution, although my use case is a little more involved.

This site is 99% public facing, it has a small single page login area accessible to a handful of users. I can’t cache that page, which is fine. However when logged in the header of the site changes (login becomes logout etc.), which affects every page, so then none of the pages can be cached.

It’s a bit of a shame to have to switch off static caching entirely just to make a very small percentage of requests work properly.

What would be ideal in this particular situation would be to disable any caching (both storing and fetching from the cache) when a user is logged in. That way all the public facing pages in their logged-out state can be cached, but if they’re requested by a logged in user the cache fetch is skipped and the page is fully rendered.*

I’ve managed to implement this by binding a custom static caching middleware class that does a user check in both canBeCached and shouldBeCached, and it works pretty well.

Having the ability to control whether a request should be fetched from the cache could be useful in other ways as well. Another option I’m testing is skipping the cache if any session flash data exists. That way you can cache pages with forms when they’re in their default blank state**, but fully render them when old/errors/success values are present.

Obviously every site is different so none of this could be implemented as a general rule, but having the option to use your own static caching middleware would be great. Binding a custom middleware class is easy enough, but perhaps there could be a built-in option in Statamic just like there is for a custom invalidator class?

*Obviously this can only work with the half measure caching.
**Requires a string replace to update the cached CSRF token .

[jasonvarga]

See statamic/cms#4046