Liferay CDN Default Configuration

Liferay configures every new Fastly service for an environment on Liferay CDN the same way. This default configuration decides which requests bypass the cache, what the CDN caches and for how long, and which headers it adds. Use this reference to see how a new service behaves before you customize it in your Fastly account. Not every deployment includes Fastly account access. See Liferay CDN for the deployments that do.

This configuration sets the service’s default TTL to 0 and defines its caching and security behavior through these VCL snippets:

Snippet	Description
recv-05-security-telemetry	It sends the visitor’s address, location, network, and TLS fingerprints to Liferay DXP as request headers.
recv-10-classify	It redirects HTTP to HTTPS and decides which requests bypass the cache.
recv-48-documents-arm-io-friendly-urls, recv-49-documents-arm-io-uuid-urls, recv-50-documents-default-width	They prepare Documents and Media images for image optimization.
miss-10-origin-token, pass-10-origin-token	They identify the service to the origin. Keep these snippets.
fetch-20-ttls	It sets what the CDN caches and for how long.
fetch-30-vary	It removes User-Agent from the Vary header, so the CDN does not split the cache by browser.
fetch-40-surrogate-key	It tags responses with surrogate keys for purging.
deliver-10-debug	It returns debug information. It is off until you turn it on. See Optional Features.
deliver-20-security-headers	It adds security headers to every response.
deliver-30-browser-cache-wipe	It clears browser caches. It is off until you turn it on. See Optional Features.

Requests That Bypass the Cache

The CDN redirects HTTP requests to HTTPS. It then sends these requests to Liferay DXP without caching them:

• Requests whose method is not GET or HEAD

• Requests with the p_l_mode=edit query parameter

• Requests from signed-in users, identified by the ID cookie that Liferay DXP sets when a user signs in through the login form

• Requests to /o/ paths that start with one of these module names:

  • account-admin
  • cms-admin
  • cms-management
  • content-dashboard
  • content-management
  • dynamic-data-mapping-form-admin
  • object-admin
  • portal-instances
  • portal-workflow
  • web-experience-admin

• Requests to these paths:

  • /api/jsonws
  • /c/portal/extend_session, /c/portal/login, /c/portal/logout, and /c/portal/update_password
  • /c/portal/saml
  • /group/[site]/~/control_panel and /web/[site]/~/control_panel
  • /o/headless-*
  • /web/cms/ and /web-cms/

Users who sign in through SAML or another single sign-on method do not have the ID cookie, so the CDN applies the guest caching rules to their requests, although they are signed in to Liferay DXP.

Cached Responses

For guest requests, the CDN caches these responses and sets the same cache duration for browsers:

Response	Cache Duration
JavaScript and CSS files with /o/ in their path and a content hash in their names, such as main.(a1b2c3).js	365 days, as immutable
Other JavaScript, CSS, font, and image files with /o/ in their path	Ten minutes
/combo	Seven days
/documents/ responses that guests can view	One day
/image/ responses	One day

Files with a content hash get a new URL on every build. Other files keep their URLs, so after a deployment the CDN and browsers can serve the previous version for up to ten minutes. The CDN removes every Set-Cookie header from the responses it caches.

The CDN does not cache any other response, including HTML pages, and sends Liferay DXP’s Cache-Control header to the browser unchanged. The CDN also never stores these responses:

• 200 responses with an empty body or no Content-Type header
• Error responses (status 400 and above)
• Responses that set a JSESSIONID cookie, except 200 image responses under /documents/ and /image/, where the CDN removes the cookie first

Although the CDN does not store error responses, on a 5xx error it serves a stale copy if it has one.

Security Headers

The CDN adds these headers to every response:

• Referrer-Policy: strict-origin-when-cross-origin
• Strict-Transport-Security: max-age=31536000; includeSubDomains
• X-Content-Type-Options: nosniff

Liferay DXP, not the CDN, sends the X-Frame-Options header.

Request Headers Sent to Liferay DXP

The CDN adds these headers to each request before sending it to Liferay DXP:

• Client-JA3 and Client-JA4: The visitor’s TLS fingerprints.
• Fastly-Client-IP: The visitor’s IP address.
• X-Client-ASN and X-Client-AS-Name: The visitor’s network.
• X-Geo-AS-Name, X-Geo-AS-Number, X-Geo-City, X-Geo-Conn-Speed, X-Geo-Country-Code, X-Geo-Country-Name, X-Geo-Lat, X-Geo-Long, X-Geo-Postal, and X-Geo-Region: The visitor’s location and network.

Purging

Unless Liferay DXP sends its own Surrogate-Key header, the CDN tags each response with the surrogate keys main and host:[hostname]. Responses under /o/[module]/ also get module:[module]. When Liferay DXP sends its own Surrogate-Key header, the CDN keeps it and adds none of these keys. Use these keys to purge all cached responses for a hostname or a module’s files. Purge requests require authentication. See Fastly’s documentation on purging.

Optional Features

The cdn_config edge dictionary controls these features. Each is off until you add its key with a value:

Key	Description
debug_token	The CDN returns the X-Fastly-Bucket response header, which shows how it classified a request, when the request’s X-Debug-Token header matches the key’s value.
wipe_token	The CDN sends Clear-Site-Data: "cache" on HTML responses once to each browser for each value of the key, which clears the browser’s cache for the site. Change the value to clear browser caches again.

With Fastly account access, you can change any part of this configuration in your Fastly service. You are responsible for the changes you make, so understand their effects first.