Loading today’s stories
Build1 distinct publisher3 min readUpdated
A dev.to guide moves cacheability rules out of the Cloudflare dashboard and into a Laravel middleware, then strips Set-Cookie from anonymous HTML so a shared cache will actually store it.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
A guide published on dev.to by the team behind web-pioneer.com describes a small Laravel middleware, called EdgeCache, that decides per response whether Cloudflare is allowed to store a page, and strips the Set-Cookie header on the responses it clears [1][2]. The interesting part is not the caching but the location of the decision: the rules ship with the application code rather than living as a toggle in the Cloudflare dashboard [3].
The blocker is mundane. According to the guide, Laravel touches the session on nearly every web request and answers with a Set-Cookie header, and any well-behaved shared cache refuses to store a response that sets a cookie [4]. The result is teams who cache images and JavaScript, leave every HTML response marked DYNAMIC, and then wonder why time to first byte from abroad is still around 600 ms [5].
So Cloudflare is reduced to one instruction: cache HTML when the origin says it is allowed to [6]. The origin is the only component that knows whether a response is safe to share between visitors, and in production the middleware sets Cache-Control: public, max-age=0, s-maxage=600 when it is, and no-cache, private when it is not [7][8]. The allowlist is explicit: GET only, status 200 only, Content-Type containing text/html, no authenticated user, and no flashed session data in _flash.new [9]. Everything else is uncacheable by default, so a new route, an error page or an authenticated area fails safe [10]. Because the rules go through code review and are covered by tests, staging behaves like production [11].
The header split is deliberate. s-maxage applies only to shared caches, so the edge holds the page for 600 seconds, ten minutes, while browsers revalidate on every visit [12][13]. The guide's reasoning is operational rather than aesthetic: a stale page at the edge can be purged centrally in seconds, and a stale page sitting in ten thousand browser caches cannot [14].
Then the line that does the real work. The middleware removes Set-Cookie before setting the cacheable header, because a cookie on a shared-cache response either blocks caching or, worse, hands one visitor's session to everyone [15]. The guide argues this is safe only because the guards run first: by the time the cookie is discarded, the response has been proven to be an anonymous 200 HTML page with no flashed state, so what is thrown away is a throwaway guest session that nothing depends on [16]. That assertion is the load-bearing one. If anything on your anonymous pages depends on guest session continuity, the guards are what has to be extended, not the strip.
Ordering matters too: the middleware is registered at the end of the web group so that it sees the fully built response with sessions attached [17]. On the Cloudflare side the guide calls for exactly one Cache Rule, matching the hostname and marking the response eligible for cache [18].
What to watch is the flash guard, since it is the only check that depends on reading per-visitor state rather than on request shape, and any feature that writes to the session on a GET will silently make pages uncacheable. Note also that this is one team's account of one site [1], and that the published excerpt offers no before-and-after measurements beyond the author's ranking of full-page HTML caching above OPcache tuning, query fixes, Redis fragment caching and queue offloading [19]. The excerpt breaks off mid-sentence in the Cloudflare configuration section [20].
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
On the Cloudflare side the guide says you need exactly one Cache Rule: match your hostname and set the response to eligible for cache.
A guide titled "Full-Page Edge Caching for Laravel Behind Cloudflare: A Practical Guide" was published on dev.to, describing how the authors solved full-page edge caching in production on web-pioneer.com, including mistakes made along the way.
The origin-side component is a small middleware the authors call EdgeCache, which is the only place that knows whether a given response is safe to share between visitors.
The guide states one design decision that everything else hangs on: cacheability logic lives in the Laravel application, not in the Cloudflare dashboard, and the rules ship with the codebase so nobody has to remember that a dashboard toggle exists.
Laravel touches the session on nearly every web request and answers with a Set-Cookie header, and any well-behaved shared cache refuses to store a response that sets a cookie.
Cloudflare's job is reduced to a single instruction: cache HTML when the origin says it is allowed to.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Concrete mechanism, no measurements
The technical core is unusually checkable for a single-source story: full middleware source, exact header strings, a guard-by-guard default-deny allowlist, standard s-maxage semantics, and a specific incident narrative about Cloudflare override mode. What is absent is any quantitative evidence — no latency, cache-hit, or origin-load figures support the performance argument, and the captured text breaks off mid-pitfall, so the evidence base is mechanistic rather than measured.
One self-reported deployment
Adoption evidence is limited to the authors' own site plus an unquantified reference to client engagements: one first-party production deployment and one account of prior misconfiguration incidents. No third-party users, no repository, package, or download signal, and no independent replication appear in the supplied material, so adoption is real but minimal.
Mildly overstated headline, solid body
The implementation detail is proportionate to the evidence, but the framing runs ahead of it: 'nothing has come close' and 'almost nobody does it for Laravel' are sweeping and unmeasured, and the 600 ms TTFB figure is illustrative rather than sampled. The cookie-stripping step is presented as simply safe without addressing follow-on token flow for visitors served a cached, cookie-free page, and the ledger's framing omits the respect-vs-override setting that the authors' own incidents show is load-bearing.
Consultancy publishing its own methodology
The authors identify themselves as a team that ships performance optimizations for Laravel clients and the reference deployment is their own site, so the piece doubles as capability marketing for paid work — a clear commercial incentive to present the pattern as decisively effective. Mitigating it, the post publishes working code, discloses two of its own production incidents, and names a debugging mistake, which is atypical of pure promotion.
Single self-published source, verifiable mechanics
Confidence is constrained by structure: one publisher, one article, one self-reported deployment, an author with a commercial stake, and a truncated capture. It is lifted above the floor because the load-bearing technical assertions are standard HTTP shared-cache semantics shown in code, which a reader can verify without trusting the authors.
build
796 pages of semantic search with no vector database, and what it cost to skip one1 distinct publisher
build
Once the question needs a cube, you own the parser1 distinct publisher
build
Anti-bot systems now score the session, which means your proxy pool is not a mitigation1 distinct publisher
build
PHP-FPM's dynamic pool is a one-second idle-worker loop, not a capacity plan1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 14, 2026