After a bit of research it looks like the Vary header won’t allow you to specify precicely which cookie is the one to watch, which means it’s not a viable solution. Any cookie change on the same domain would trigger a cache re-request :( For the moment, it looks like cache-control: private is the only solution that will allow AI to work for the end user and not let proxies get in the way.
Matt Wilcox
After a bit of research it looks like the Vary header won’t allow you to specify precicely which cookie is the one to watch, which means it’s not a viable solution. Any cookie change on the same domain would trigger a cache re-request :( For the moment, it looks like cache-control: private is the only solution that will allow AI to work for the end user and not let proxies get in the way.