Afaik changing sessionid on login and logout is best practice anyways. We should recommend that when caching the hash request, and add a note that you can again tag this response and invalidate if your logout needs to be secure or you dont change the session id.

But how to handle that a session in php needs to be visited from time to time to stay alive?

----- Reply message -----
Von: "Joel Wurtz" <notifications@github.com>
An: "FriendsOfSymfony/FOSHttpCache" <FOSHttpCache@noreply.github.com>
Cc: "David Buchmann" <david@liip.ch>
Betreff: [FOSHttpCache] Improve user context caching docs (#66)
Datum: So., Mai. 18, 2014 21:45
In doc/user-context.md: 
>  ``` 
>   
> -The homepage which has a different view if the user is logged in or not. 
> +Here we say that the hash is valid for one hour. A good practice is to give 
> +`max-age` the same value as your user session timeout. 

After implementing this solution i agree with dbu the good practice is wrong as this can have some bad effects:  

Like, i'm a anonymous user, i logged in but my session id is the same, in this case we need to invalidate the hash (best way is to change the session id) or we will have page like we were never logged in :/ 

IMO, we should say that caching the HEAD request is possible but need extra work to invalidate the hash on right / authentication changes. 

&mdash;
Reply to this email directly or view it on GitHub.