Cache 심화 실습

Part I — 기초

S01 Default Cache Behavior   S02 Default Edge TTL

Part II — Cache Rules

S03 Cache Everything   S04 Bypass   S05 Edge TTL 3모드
S06 Status Code TTL   S07 Browser TTL   S08 Serve Stale
S09 Strong ETags   S10 Origin Cache Control   S11 Error Passthrough

Part III — Cache Key

S12 Query String   S13 Cookie 분기   S14 User Features
S15 Cache Deception Armor   S16 Bypass on Cookie

Part IV — Purge

S17 Single File   S18 Prefix   S19 Cache Tags
S20 Custom Cache Key   S21 Everything

Part V — 고급

S22 Tiered Cache   S23 Cache Reserve   S24 QS Sort
S25 CDN-Cache-Control   S26 Always Online   S27 Dev Mode
S28 Early Hints   S29 Crawler Hints   S30 Vary for Images

Part VI~VIII

S31 Revalidation   S32 Cache Poisoning   S33 CORS
S34 Cache Analytics   S35 Rule Priority

기본 캐시 대상 (파일 확장자 기반)

# CSS → HIT (기본 캐시)
curl -sI "https://$ZONE/static/style.css" | grep cf-cache-status
# → MISS 첫 요청 후 HIT

# HTML → DYNAMIC (기본 미캐시)
curl -sI "https://$ZONE/html/page.html" | grep cf-cache-status
# → DYNAMIC

# Set-Cookie → BYPASS
curl -sI "https://$ZONE/s13/set-cookie?group=A" | grep cf-cache-status
# → BYPASS

# 200 → 120분 캐시
curl -sI "https://$ZONE/s02/asset.js" | grep -i "age\|cf-cache-status"

# 404 → 3분 캐시
curl -sI "https://$ZONE/s06/nonexist"
sleep 10
curl -sI "https://$ZONE/s06/nonexist" | grep cf-cache-status
# → HIT (3분 내)

sleep 190
curl -sI "https://$ZONE/s06/nonexist" | grep cf-cache-status
# → EXPIRED (3분 초과)

Cache Rule

When: URI Path contains /s04/
Then: Cache eligibility → Bypass cache

# Bypass 규칙 적용 후
curl -sI "https://$ZONE/s04/page" | grep cf-cache-status
# → DYNAMIC (항상 origin 요청)

# Rule: URI=/s03/page
# Edge TTL: Status Code TTL
#   200 → 300s
#   404 → 10s
#   5xx → 0s (no-cache)

# 200 페이지
curl -sI "https://$ZONE/s03/page" | grep cf-cache-status
# HIT → age 증가 (300초 기준)

# 404 페이지 (10초)
curl -sI "https://$ZONE/s06/nonexist"  # MISS
sleep 5 && curl -sI ... | grep cf-cache-status  # HIT
sleep 8 && curl -sI ... | grep cf-cache-status  # EXPIRED

# Rule: URI ends with .css
# Browser TTL: Override → 86400s
curl -sI "https://$ZONE/s07/style.css" | grep -i cache-control
# Cache-Control: max-age=86400

# Rule: URI=/s08/resource, Edge TTL: 10s
# Serve stale: ON (기본값)
curl -sI "https://$ZONE/s08/resource"  # MISS
sleep 12
curl -sI "https://$ZONE/s08/resource" | grep cf-cache-status
# UPDATING (stale 서빙 + 백그라운드 fetch)
curl -sI "https://$ZONE/s08/resource" | grep cf-cache-status
# HIT (새 콘텐츠 저장 완료)

# Rule: URI=/s09/resource.js
# Respect Strong ETags: ON

# 1) ETag 확인
curl -sI "https://$ZONE/s09/resource.js" | grep -i etag
# ETag: "f1418e1e8c06cc233cd2ce40fd9340ca"

# 2) If-None-Match 조건부 요청
ETAG=$(curl -sI "https://$ZONE/s09/resource.js" | grep -i etag | awk '{print $2}')
curl -sI "https://$ZONE/s09/resource.js" -H "If-None-Match: $ETAG"
# HTTP/2 304 + cf-cache-status: REVALIDATED

# OFF (기본): CF 기본 에러 페이지
curl -s "https://$ZONE/s11/down" | grep -i "cloudflare\|error"

# Cache Rule: URI=/s11/down
# Origin error page pass-through: ON
curl -s "https://$ZONE/s11/down" | grep -i "서비스 점검\|X-Error-From"
# origin 실제 에러 페이지 반환

# Rule: URI=/s13/landing
# Cache Key > Cookie: ab_group (include value)

# 쿠키 없이
curl -sI "https://$ZONE/s13/landing"  # MISS

# A 그룹
curl -sI "https://$ZONE/s13/landing" -H "Cookie: ab_group=A"
# MISS (별도 Cache Key)

# B 그룹
curl -sI "https://$ZONE/s13/landing" -H "Cookie: ab_group=B"
# MISS (또 다른 Cache Key)

# A 그룹 재요청
curl -sI "https://$ZONE/s13/landing" -H "Cookie: ab_group=A"
# HIT ✅

# Rule: URI=/s14/content
# Cache Key > User > Device Type: ON

# 모바일
curl -sI "https://$ZONE/s14/content" \
  -H "User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_0)"

# 데스크톱
curl -sI "https://$ZONE/s14/content" \
  -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64)"
# 각각 별도 Cache Key → 별도 HIT

# ⚠️ 취약 상태 (Cache Deception Armor OFF)
# /user/profile.css → origin이 text/html 반환
curl -sI "https://$ZONE/user/profile.css" | grep -i "content-type\|cf-cache-status"
# Content-Type: text/html
# cf-cache-status: HIT ← 위험! 개인정보 캐시됨

# ✅ Cache Deception Armor ON
# Cache Rule: Cache Deception Armor: ON
curl -sI "https://$ZONE/user/profile.css" | grep cf-cache-status
# MISS or BYPASS (Content-Type 불일치 → 캐시 거부)

Dashboard

Caching > Configuration > Purge Cache > Purge by URL
URL: https://$ZONE/static/style.css

API

curl -X POST \
  "https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/purge_cache" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  --data '{"files": ["https://<zone>/static/style.css"]}'

# Purge 전
curl -sI "https://$ZONE/static/style.css" | grep cf-cache-status
# HIT

# Purge 실행 후
curl -sI "https://$ZONE/static/style.css" | grep cf-cache-status
# MISS ← 제거됨

서버가 Cache-Tag 헤더 반환:

# product-123 태그 Purge
--data '{"tags": ["product-123"]}'

# 결과
/s19/product/123 → MISS (product-123 포함)
/s19/product/456 → HIT  (product-456만 포함)
/s19/category/merchandise → MISS (공유 태그 포함)

[사용자] → [CF 로컬 PoP]
             ↓ Miss
         [CF 상위 PoP (Tier)]
             ↓ Miss
         [Origin]

# Caching > Tiered Cache > Smart → Enable
# 여러 PoP에서 요청 시 Tier PoP 캐시 활용
curl -sI "https://$ZONE/s22/page" | grep -i "cf-ray\|cf-cache-status"
# CF-Ray: a1b2c3-ICN (서울 PoP)
# cf-cache-status: HIT (Tier PoP에서 서빙)

# Caching > Cache Reserve → Enable
# Rule: File extension in [zip, mp4, dmg]
# Cache Reserve Eligibility: ON
# Minimum file size: 10,000,000 (10MB)

# 테스트 파일
curl -sI "https://$ZONE/s23/installer.zip" \
  | grep -i "cf-cache-status\|content-length"
# Content-Length: 10485760 (10MB)
# cf-cache-status: HIT (R2에 영구 저장)

S24 — Query String Sort

# Caching > Configuration > Query String Sort: ON
# 또는 Cache Rule > Cache Key > Sort QS

curl -sI "https://$ZONE/s12/items?b=2&a=1"  # MISS
curl -sI "https://$ZONE/s12/items?a=1&b=2"  # HIT ✅
# 내부 정렬 → 동일 Cache Key

S25 — CDN-Cache-Control

curl -sI "https://$ZONE/s25/api/catalog" \
  | grep -iE "cache-control|cdn-cache"
# Cache-Control: public, max-age=60     (브라우저)
# CDN-Cache-Control: max-age=86400      (CF Edge)
# 브라우저: 60초, CF: 86400초 독립 캐시

# 1) Always Online: ON
#    Caching > Configuration > Always Online

# 2) 사전 캐시
# Rule: URI=/s26/recovery, Eligible, TTL=300s
curl -sI "https://$ZONE/s26/recovery"  # MISS→HIT

# 3) Origin Down 시뮬레이션
# /s26/down?always=1 → 항상 503

# 4) Stale 서빙 확인
curl -sI "https://$ZONE/s26/recovery" \
  | grep cf-cache-status
# STALE ← Always Online이 캐시 서빙

S27 — Development Mode

# Caching > Configuration > Development Mode: ON
# 3시간 동안 모든 캐시 무력화

curl -sI "https://$ZONE/static/style.css" \
  | grep cf-cache-status
# BYPASS (Dev Mode 중)

S28 — Early Hints (103)

# Speed > Optimization > Early Hints: ON
curl -sI "https://$ZONE/s28/page" \
  | grep -i "link"
# Link: </static/style.css>; rel=preload; as=style,
#       </static/app.js>; rel=preload; as=script
# CF가 origin 응답 전에 103 전송
# 브라우저가 CSS/JS 선제 로드

S29 — Crawler Hints

# Caching > Configuration > Crawler Hints: ON

# 1) 캐시
curl -sI "https://$ZONE/s29/blog/post"  # HIT

# 2) Purge → IndexNow 자동 전송
# Bing/Yandex에 변경 알림
--data '{"files": ["https://<zone>/s29/blog/post"]}'

S30 — Vary for Images

# Speed > Polish: ON, Vary for Images: ON

# WebP 지원 브라우저
curl -sI "https://$ZONE/s30/hero.jpg" \
  -H "Accept: image/webp" | grep -i "content-type\|x-image-format"
# Content-Type: image/webp

# 레거시 브라우저
curl -sI "https://$ZONE/s30/hero.jpg" \
  -H "Accept: image/jpeg" | grep -i "content-type"
# Content-Type: image/jpeg

# Rule: URI=/s31/resource.js
# Respect Strong ETags: ON
# Edge TTL: respect_origin (max-age=10 반환)

# 1) MISS + ETag 확인
curl -sI "https://$ZONE/s31/resource.js" \
  | grep -i "etag\|cf-cache-status"
# ETag: "f1418e1e8c06cc233cd2ce40fd9340ca"
# cf-cache-status: MISS

# 2) HIT
curl -sI "https://$ZONE/s31/resource.js" | grep cf-cache-status
# HIT (age 증가)

# 3) TTL 만료 후 (10초)
sleep 12
curl -sI "https://$ZONE/s31/resource.js" | grep cf-cache-status
# REVALIDATED (CF→origin If-None-Match → 304)

S32 — Cache Poisoning 테스트

# 서버: /s32/reflect → X-Forwarded-Host 반영
curl -sI "https://$ZONE/s32/reflect" \
  -H "X-Forwarded-Host: evil.com" | grep -i x-reflected
# X-Reflected-Host: evil.com

# 방어: Transform Rule로 X-Forwarded-Host 제거
# 또는 URL 정규화 활성화

S33 — CORS 캐시

# /s33/api/data → Access-Control-Allow-Origin: *
#               + Vary: Origin
curl -sI "https://$ZONE/s33/api/data" \
  -H "Origin: https://app-a.example.com" \
  | grep -i "access-control\|vary\|cf-cache-status"

# CF는 기본적으로 Origin 헤더를
# Cache Key에 포함 → CORS 응답 안전

Cache Rules 설정

☐ Cache Eligibility (Bypass/Eligible)
☐ Edge TTL 3가지 모드
☐ Status Code TTL
☐ Browser TTL
☐ Serve Stale
☐ Respect Strong ETags
☐ Origin Cache Control
☐ Origin Error Page Pass-through
☐ Cache Deception Armor
☐ Cache Key (QS / Cookie / User)

Purge

☐ Single File
☐ Prefix
☐ Cache Tags
☐ Custom Cache Key
☐ Everything

고급 기능

☐ Tiered Cache
☐ Cache Reserve
☐ CDN-Cache-Control
☐ Always Online
☐ Early Hints / Crawler Hints
☐ Vary for Images