CLOUDFLARE has introduced support for the HTTP `Vary` response header in Cache Rules on its Free, Pro, Business and Enterprise plans. The feature is designed for sites that serve different representations from the same URL, such as HTML or JSON, different image formats, or content in different languages. `Vary` tells a cache which request headers may affect the response, but raw header values can create large numbers of effectively identical cache entries.
Cloudflare says an analysis of more than 120 million responses from nearly 50,000 popular sites found almost 3,000 varying on four or more fields, with some varying on 10, 23 or 47 fields.
The new controls let customers choose how Cloudflare handles each header named by an origin. `normalize` groups equivalent requests and is recommended for negotiation headers such as `Accept`, `Accept-Language` and `Accept-Encoding`; `passthrough` matches exact header bytes where every difference matters; and `bypass` prevents storage for personalised or high-cardinality fields such as `Cookie` or `User-Agent`. `Vary: *` always bypasses the cache.
Cloudflare stresses that origins must return the appropriate `Vary` header consistently, including for errors and fallback responses, or responses could be cached without the required separation. Configuration is available through the dashboard, Rulesets API and Terraform. Changing the policy does not automatically purge existing entries, so affected content may need to expire or be purged.