JSON Caching Strategies: HTTP Headers, Redis, CDN, and Cache Invalidation

Written and reviewed by the Jsonic editorial team — every guide is verified against the official spec or runtime before publication.

Last updated: May 19, 2026

Effective caching is the single highest-leverage performance improvement for JSON APIs. A well-cached API response serves in under 5ms instead of 200ms, handles 100× more traffic, and reduces database load dramatically. This guide covers the full stack: HTTP cache headers, Redis application caching, CDN edge caching, and cache invalidation strategies.

HTTP Cache-Control Headers for JSON APIs

// Express.js — Cache-Control header patterns

// Public JSON data (product catalog, public profiles)
res.set({
  'Cache-Control': 'public, max-age=300, stale-while-revalidate=60',
  'Content-Type':  'application/json',
  'Vary':          'Accept-Encoding',
})

// User-specific data (dashboard, account info)
res.set({
  'Cache-Control': 'private, max-age=60',
  'Content-Type':  'application/json',
})

// Real-time data (stock prices, live inventory)
res.set({
  'Cache-Control': 'no-store',
  'Content-Type':  'application/json',
})

// Frequently checked but rarely changed (config, feature flags)
res.set({
  'Cache-Control': 'public, max-age=0, must-revalidate',
  'ETag':          etag,           // hash of response body
  'Last-Modified': lastModified,   // ISO 8601 string
  'Content-Type':  'application/json',
})

ETag Implementation

ETag enables conditional GET: the client sends the cached ETag; the server returns 304 Not Modified (no body) if unchanged.

import crypto from 'crypto'

function generateETag(data: unknown): string {
  const hash = crypto
    .createHash('md5')
    .update(JSON.stringify(data))
    .digest('hex')
  return '"' + hash + '"'  // ETags must be quoted strings
}

// Express middleware
app.get('/api/products', async (req, res) => {
  const products = await db.getProducts()
  const etag = generateETag(products)

  // Check conditional request
  if (req.headers['if-none-match'] === etag) {
    return res.status(304).end()  // Not Modified — no body sent
  }

  res
    .set('ETag', etag)
    .set('Cache-Control', 'public, max-age=0, must-revalidate')
    .json(products)
})

Redis Application Cache

import { Redis } from 'ioredis'
const redis = new Redis(process.env.REDIS_URL)

const CACHE_TTL = 300  // 5 minutes

// Cache-aside (lazy loading) pattern
async function getUser(userId: string) {
  const key = `user:${userId}`

  // 1. Check cache
  const cached = await redis.get(key)
  if (cached) {
    return JSON.parse(cached)  // cache hit
  }

  // 2. Cache miss — fetch from DB
  const user = await db.findUser(userId)
  if (!user) return null

  // 3. Store in cache with TTL
  await redis.setex(key, CACHE_TTL, JSON.stringify(user))

  return user
}

// Invalidate on update
async function updateUser(userId: string, data: Partial<User>) {
  const updated = await db.updateUser(userId, data)
  await redis.del(`user:${userId}`)  // bust the cache
  return updated
}

// Cache list queries with composite key
async function getProductsByCategory(categoryId: string, page: number) {
  const key = `products:cat:${categoryId}:page:${page}`
  const cached = await redis.get(key)
  if (cached) return JSON.parse(cached)

  const products = await db.getProducts({ categoryId, page })
  await redis.setex(key, 60, JSON.stringify(products))  // shorter TTL for lists
  return products
}

Cache Key Design

CDN Caching for JSON APIs

// Set s-maxage for CDN-specific TTL (overrides max-age for CDNs)
res.set({
  'Cache-Control': 'public, max-age=60, s-maxage=300',
  // CDNs cache for 300s; browsers cache for 60s
})

// Cloudflare: add Cache-Tag for surrogate-key invalidation
res.set({
  'Cache-Control': 'public, max-age=300',
  'Cache-Tag':     'products product:123 category:electronics',
})

// Purge by tag via Cloudflare API when product 123 changes:
// POST https://api.cloudflare.com/client/v4/zones/{zoneId}/cache/tags
// { "tags": ["product:123"] }

// Fastly: Surrogate-Key header for tag-based purging
res.set({
  'Surrogate-Key':     'products product-123',
  'Surrogate-Control': 'max-age=300',
})

Cache Invalidation Patterns

// 1. Event-driven invalidation (immediate consistency)
async function updateProduct(id: string, data: Partial<Product>) {
  const updated = await db.updateProduct(id, data)

  // Delete all affected cache entries
  await redis.del(`product:${id}`)
  await redis.del(`products:featured`)  // featured list may include this product

  // Publish event for other services to invalidate their caches
  await pubsub.publish('product.updated', { id, ...data })

  return updated
}

// 2. Versioned keys — no explicit deletion needed
let productVersion = await redis.get('products:version') ?? '1'

async function getProductsV(version: string) {
  const key = `products:v:${version}`
  const cached = await redis.get(key)
  if (cached) return JSON.parse(cached)
  const products = await db.getProducts()
  await redis.setex(key, 3600, JSON.stringify(products))
  return products
}

async function invalidateProductCache() {
  const newVersion = Date.now().toString()
  await redis.set('products:version', newVersion)
  // Old versioned keys expire naturally after 1 hour
}

// 3. Write-through cache (always consistent)
async function setUser(userId: string, user: User) {
  const [dbResult] = await Promise.all([
    db.saveUser(userId, user),
    redis.setex(`user:${userId}`, 300, JSON.stringify(user)),
  ])
  return dbResult
}

stale-while-revalidate Pattern

// Server: set stale-while-revalidate for background refresh
res.set('Cache-Control', 'public, max-age=60, stale-while-revalidate=300')
// Clients/CDNs serve stale (up to 5 min old) while fetching fresh in background

// Application-level SWR with Redis
async function getWithSWR(key: string, fetchFn: () => Promise<unknown>, ttl: number) {
  const cached = await redis.get(key)

  if (cached) {
    const { data, expiresAt } = JSON.parse(cached)
    const isStale = Date.now() > expiresAt

    if (isStale) {
      // Return stale immediately, refresh in background
      fetchFn()
        .then(fresh => redis.setex(key, ttl, JSON.stringify({
          data: fresh,
          expiresAt: Date.now() + ttl * 1000,
        })))
        .catch(console.error)
    }

    return data  // always return cached data immediately
  }

  // No cache — must wait for fresh data
  const fresh = await fetchFn()
  await redis.setex(key, ttl, JSON.stringify({
    data: fresh,
    expiresAt: Date.now() + ttl * 1000,
  }))
  return fresh
}

Caching Decision Guide

FAQ