full page caching in general and Django

Transcript

1. Things Caches Do HTTP / Headers
2. kinds of web caches • Browser Caches • Proxy Caches • Gateway Caches
3. Gateway caches • Varnish on your server • CDN • „reverse proxy“
4. expiration • Cache-Control: max-age=N • Expires (for your CDN) • Surrogate-Control: max-age=N • Cache-Control: s-max-age=N
5. expiration
6. expiration
7. validation • Last-Modified / If-Modified-Since • ETag / If-None-Match • HTTP Response: 304 Not Modified
8. validation
9. validation
10. cache key
11. cache key https://api.thermondo.de/settings/
12. cache key https://api.thermondo.de/settings/ • method (GET) • path (/api/settings/) • GET arguments (most times) • more?
13. cache key https://api.thermondo.de/settings/ • method (GET) • path (/api/settings/) • GET arguments (most times) • Language • Encoding • more?
14. cache key https://api.thermondo.de/settings/ • method (GET) • path (/api/settings/) • GET arguments (most times) • Language • Encoding • User Session
15. vary $ http -h https://api.thermondo.de/settings/ „Authorization: Token secrettoken" HTTP/1.1 200 OK Allow: GET, HEAD, OPTIONS Api-Version: 1.0.0 Connection: keep-alive Content-Encoding: gzip Content-Language: en-us Content-Length: 646 Content-Type: application/json Date: Mon, 30 Mar 2015 12:48:31 GMT Etag: "9987fab5ec7adb7c70be2a24e3665a5b;gzip" Server: waitress Vary: Accept, Accept-Language, Cookie, Accept-Encoding Via: 1.1 vegur
16. vary $ http -h https://api.thermondo.de/settings/ „Authorization: Token secrettoken" HTTP/1.1 200 OK Allow: GET, HEAD, OPTIONS Api-Version: 1.0.0 Connection: keep-alive Content-Encoding: gzip Content-Language: en-us Content-Length: 646 Content-Type: application/json Date: Mon, 30 Mar 2015 12:48:31 GMT Etag: "9987fab5ec7adb7c70be2a24e3665a5b;gzip" Vary: Accept, Accept-Language, Cookie, Accept-Encoding Via: 1.1 vegur
17. on cookies
18. on cookies • session • google analytics • often breaks caching
19. on csrf • different content per session • often breaks caching
20. Static Files js / css / images
21. the best way (tm) • unique filenames + far future expiration (1 year) or • normal filenames, short expiration (5 min) or • normal filenames, CDN only expiration
 (and flush the CDN after changes)
22. Page Caching in Django
23. Middleware
24. validation • CommonMiddleware • adds an ETag to the response if there is none • Conditional GET for ETag • generates new 304 response if ETag matches
 (keeps cookies)
25. validation • ConditionalGetMiddleware • Conditional GET for ETag and Last-Modified • changes the response status code to 304 if conditions match
26. validation • @etag, @last_modified, @condition • callables for ETag or Last-Modified calculation • best server performance • most RFC compliant
27. validation • GZipMiddleware • breaks Django’s ETag handling • changes ETag in response
28. expiration • FetchFromCacheMiddleware has to be last: 
 after everything that modifies the Vary-Header • UpdateCacheMiddleware has to be first: 
 before everything that modifies the Vary-Header
29. Middleware
30. vary • SessionMiddleware adds Cookie • GZipMiddleware adds Accept-Encoding • LocaleMiddleware adds Accept-Language • @vary_on_cookie, @vary_on_headers
31. Django sucks here but it’s right
32. expiration breaks • when you use sessions • when you use CSRF protection (which uses cookies) • when you use google analytics
33. easy (wrong) way • drop vary header in custom middleware (security risk, wrong data)
34. possible but hard way • Middleware to filter google analytics cookies and add them back later 
 they have no effect on the content • be very careful with using the session / user in your views • be very careful with using forms (which use CSRF Protection)
35. other ways • don’t use normal expiration headers • only flushable store (local cache, CDN) • flush the cache (for example) when the database changes
36. not included • @cache_control (private, public, revalidate, …) • stale expire headers