skills/cache-strategy-invalidation-expert/SKILL.md
Redis caching patterns, cache-aside, write-through, TTL strategies, and invalidation. Activate on: caching, Redis, cache invalidation, cache-aside, write-through, TTL, CDN cache, stale-while-revalidate. NOT for: CDN/reverse proxy setup (use api-gateway-reverse-proxy-expert), database query optimization (use data-warehouse-optimizer).
npx skillsauth add curiositech/windags-skills cache-strategy-invalidation-expertInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Design and implement caching architectures using Redis, application-level caching, and CDN layers with reliable invalidation strategies.
Activate on: "caching", "Redis cache", "cache invalidation", "cache-aside", "write-through", "TTL", "stale-while-revalidate", "cache stampede", "cache warming"
NOT for: CDN/proxy configuration → api-gateway-reverse-proxy-expert | Database query tuning → data-warehouse-optimizer | Connection pooling → database-connection-pool-manager
| Domain | Technologies | |--------|-------------| | In-Memory | Redis 7.4+, Valkey, DragonflyDB, KeyDB | | Application | Node LRU cache, Cacheable, unstorage | | HTTP/CDN | Cache-Control, stale-while-revalidate, Surrogate-Key | | Multi-Layer | L1 (in-process) → L2 (Redis) → L3 (CDN) | | Invalidation | Event-driven purge, TTL, tag-based (Surrogate-Key) |
import { Redis } from 'ioredis';
const redis = new Redis();
const LOCK_TTL = 5; // seconds
async function cacheAside<T>(
key: string,
ttl: number,
fetcher: () => Promise<T>
): Promise<T> {
// Try cache first
const cached = await redis.get(key);
if (cached) return JSON.parse(cached);
// Acquire lock to prevent stampede
const lockKey = `lock:${key}`;
const acquired = await redis.set(lockKey, '1', 'EX', LOCK_TTL, 'NX');
if (!acquired) {
// Another process is fetching — wait and retry
await new Promise(r => setTimeout(r, 100));
return cacheAside(key, ttl, fetcher);
}
try {
const data = await fetcher();
await redis.set(key, JSON.stringify(data), 'EX', ttl);
return data;
} finally {
await redis.del(lockKey);
}
}
Request → L1: In-Process (LRU, 100ms TTL, ~1000 items)
│ miss
↓
L2: Redis (5-60min TTL, shared across instances)
│ miss
↓
L3: CDN (Cache-Control headers, edge-cached)
│ miss
↓
Origin (database/API)
Invalidation flows BACKWARD:
Database change → Purge L2 (Redis DEL) → L1 expires via short TTL
→ Purge L3 (Surrogate-Key purge / CDN API)
// On data change, publish invalidation event
async function updateUser(userId: string, data: UserUpdate) {
await db.users.update(userId, data);
// Invalidate all cache layers
await redis.del(`user:${userId}`);
await redis.del(`user:${userId}:profile`);
// Publish for other instances' L1 caches
await redis.publish('cache:invalidate', JSON.stringify({
pattern: `user:${userId}:*`,
timestamp: Date.now(),
}));
// CDN purge by surrogate key
await cdn.purgeTag(`user-${userId}`);
}
KEYS user:* blocks Redis; use sets to track related keys or hash structuresKEYS * or SCAN in hot paths (use sets for key tracking)tools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.