Cache Bypass Cookies
What a Cache Bypass Means
A cache bypass is a rule that sends a request straight to the origin server instead of answering it from the cache. Cache bypass cookies are cookies that trigger this rule. When a browser sends a cookie that marks the visitor as logged in, or that holds a shopping cart, the cache steps aside and the page is generated fresh for that visitor.
The reason is privacy and correctness. A cached page is the same for every visitor who receives it. If the cache served a page showing one customer's account details to another visitor, that would be a serious data leak. A cart works the same way: the items and total must match the visitor's own session.
Common situations that skip the cache include:
- Logged-in users, identified by a session cookie.
- Shopping carts and checkout, which store per-visitor state.
- Admin and preview screens, where editors need the latest unsaved content.
- Forms with personal tokens, which must not be reused between visitors.
The Performance Cost of Bypassing the Cache
Every bypassed request costs the origin server the full work of generating a page, including running application code and database queries. If a store's cart, account and checkout pages make up a large share of traffic, the cache hit ratio falls and server load stays high. Logged-in customers are often the most valuable visitors, so slow pages for them matter.
Careless cookie rules cause problems in the other direction. If a cache ignores a session cookie, it may serve one person's page to someone else. Good setups keep public pages, such as category listings, in a page cache and bypass only the pages that are personal.
Lowering the cost of bypassed requests is another option. Object caching stores database results in memory, so each generated page is cheaper to build even when the page itself cannot be cached.
Frequently asked questions
Why does my cart look empty when I come back to a site?
A cart is stored for each visitor, usually in a cookie and on the server. If a cache serves a stored page without checking that cookie, the page can show a cart that is empty or that belongs to nobody. Sites avoid this by bypassing the cache for cart and checkout pages and for any request that carries a session cookie.
Do logged-in users always get slower pages?
Often, yes, because their personal pages cannot come from a full-page cache. Object caching and faster application code can narrow the difference. Public parts of the site, such as shared images and stylesheets, usually stay cached for everyone, so the overall experience can remain fast. The split between cacheable and personal content is explained in static vs dynamic content caching.