ASP.NET Core Renderer Cache-Control breaking changes

ASP.NET Core

Overview

PREREQUISITES: The described breaking changes are introduced in version Sitefinity CMS 15.4.8634.

This article explains the Cache-Control behavior changes in the ASP.NET Core Renderer and how to update your existing configuration safely. It applies when you upgrade from an earlier Sitefinity CMS 15.3 version to the current one.

The previous Renderer behavior treats CDN caching as a special mode:

• Set OutputCacheDuration to 0.
• Configure OutputCacheAuthKey.
• The Renderer forwarded the Sitefinity CMS page Cache-Control header to the CDN.

The current Renderer behavior separates the two cache layers:

• The Renderer output cache can remain enabled.
• CDN forwarding is explicitly controlled by CdnCacheControl.
• CDN forwarding requires OutputCacheAuthKey and a qualifying Sitefinity CMS response.
• The default CdnCacheControl value is Off, so the Renderer returns Cache-Control: no-cache unless CDN forwarding is enabled.

IMPORTANT: Set CdnCacheControl explicitly for every deployment that expects CDN caching. Otherwise, the Renderer stops forwarding the CDN cache header after the upgrade.

For general configuration of the two cache layers, see Configure cache.

Summary of breaking changes

Choose the correct upgrade path

Existing CDN-only deployment

This is the deployment pattern described in Sitefinity 15.3 documentation: the Renderer's output cache is disabled and the CDN is the only page cache.

To retain this pattern, keep OutputCacheDuration: 0 and add the following new settings:

{
  "Sitefinity": {
    "OutputCacheDuration": 0,
    "OutputCacheAuthKey": "YOUR-SHARED-SECRET-HERE",
    "CdnCacheControl": "DefaultVariationOnly"
  }
}

DefaultVariationOnly is appropriate for standard CDN caching.

Renderer cache plus CDN

The current recommended model can keep the Renderer output cache enabled and also allow the CDN to cache the response:

{
  "Sitefinity": {
    "OutputCacheDuration": 3600,
    "OutputCacheAuthKey": "YOUR-SHARED-SECRET-HERE",
    "CdnCacheControl": "DefaultVariationOnly"
  }
}

Use a longer OutputCacheDuration only when Renderer cache invalidation is configured. Sitefinity CMS must be able to invalidate Renderer entries through a webhook, direct HTTP purge, or shared Redis.

Why OutputCacheAuthKey is now required

The Renderer uses the shared key for cache dependency registration and cache invalidation. Current CDN forwarding also requires this key, so a public cache response is paired with an invalidation path.

Configure the same value in both applications:

Sitefinity CMS (web.config):

<appSettings>
  <add key="sf-env:systemConfig/outputCacheSettings/cacheService:authenticationKey"
       value="YOUR-SHARED-SECRET-HERE" />
</appSettings>

Renderer (appsettings.json):

{
  "Sitefinity": {
    "OutputCacheAuthKey": "YOUR-SHARED-SECRET-HERE"
  }
}

IMPORTANT: Do not treat the authentication key as a CDN toggle. Set CdnCacheControl as well.

RespectServerCacheControlHeader is not the replacement

RespectServerCacheControlHeader is retained as an obsolete compatibility property. It controls whether a Sitefinity CMS no-cache response prevents storage in the Renderer output cache.

It does not enable CDN Cache-Control forwarding. Use CdnCacheControl for CDN behavior:

• Off: always return no-cache to downstream CDN or reverse-proxy layers.
• DefaultVariationOnly: forward the Sitefinity CMS public cache header for the default anonymous variation.
• AllVariations: forward the Sitefinity CMS public cache header for all requests, including role-based cache variations.

Important response conditions

Even with CdnCacheControl enabled, the Renderer returns no-cache when any of the following applies:

• OutputCacheAuthKey is empty.
• The request is not a live page request.
• The Sitefinity CMS page-model response does not include sf-cache-key.
• The Sitefinity CMS page response does not include Cache-Control: public.
• The Sitefinity CMS response contains a no-cache directive.
• The page is personalized or otherwise not eligible for output caching.

If some Sitefinity CMS API responses do not return sf-cache-key, the Renderer can use OutputCacheMissingKeysDuration as a shorter fallback TTL. Set it to 0 to avoid caching pages with incomplete dependency coverage.

Upgrade checklist

1. Search the Renderer configuration for existing CDN deployments.
2. Add CdnCacheControl explicitly; do not rely on its default.
3. Add and synchronize OutputCacheAuthKey on Sitefinity CMS and the Renderer.
4. For CDN-only deployments, decide whether to keep OutputCacheDuration = 0.
5. For Renderer-plus-CDN deployments, configure Renderer cache invalidation before increasing the Renderer TTL.
6. Use DefaultVariationOnly for standard CDN caching.
7. Recycle the Sitefinity CMS application and restart the Renderer.
8. Verify the response headers after deployment.

Verification commands

Replace the host name with the Renderer host:

curl.exe -I https://renderer.example.com/sample-page

For an anonymous CDN-enabled page, expect the Sitefinity CMS page directive, for example:

Cache-Control: public, max-age=300

For a deployment with CDN forwarding disabled, expect:

Cache-Control: no-cache

Also verify that:

• The response contains sf-cache-status only when EnableOutputCacheStatusHeader is enabled.
• The Sitefinity CMS page-model response contains sf-cache-key when dependency registration is expected.
• Publishing the page purges the Renderer cache before the CDN purge when using direct HTTP purge or shared Redis.

Additional resources

• Configure cache