Cloudfront 404 handling

Question

Cloudfront appears to cache 404 responses from my custom origin. I do not set Cache-Control max-age header or a Cache-Control s-maxage header. According to 
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/HTTPStatusCodes.html#HTTPStatusCodes-no-custom-error-pages
Cloudfront caches the page for 10 seconds by default.

Does setting Cache-Control: private prevent caching? What if my other response headers contain private information? The information might be seen by others, I think?

Answer

Hi there,
 
Setting Cache-Control:private does not preventing caching of an error response, the private response directive indicates that the response can be stored only in a private cache and not in shared caches such as CloudFront/CDN.

This is how CloudFront behaves with cache-control:private, If CloudFront gets an object from the origin that includes the Cache-Control: no-cache, no-store, and/or private directives, and then later CloudFront gets another viewer request for the same object, CloudFront tries to contact the origin to fulfill the viewer request.

You also asked if private information in your other response headers might be seen by others, yes it can. If your response contain cache-control private then CloudFront will not cache as per the doc but the files will be publicly accessible as the directive private is specific to caching. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html

A workaround to ensure that the error response is not cached is to configure a dummy error page on CloudFront and then set a TTL of 0seconds. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/GeneratingCustomErrorResponses.html

Cloudfront 404 handling

Contenido relevante