How to clear Electric SQL cache on logout?

[pasha-omni]

What is the recommended way of clearing any cached Electric data when the user logs out?

In my scenario I have a proxy that modifies the shape request based on user's id -- which means that the same shape request from the client would return different response by the server. However, if the response from one user gets cached, and then another user logs in from the same computer, then they would see the cached data of the first user. This is rather disastrous, so ideally i'd like to clear any cached data upon user's logout...

[KyleAMathews]

If you use a cookie or header authorization the browser will use a separate cache for requests for each logged in user.

[pasha-omni]

Thank you, I've been reading the MDN article on caching, and comparing it with the response headers sent by the ElectricSQL server:

  date: Tue, 19 Aug 2025 01:11:44 GMT
  vary: accept-encoding
  cache-control: public, max-age=60, stale-while-revalidate=300
  x-request-id: GF0F450QE4zEBTkACpHB
  electric-server: ElectricSQL/1.1.0
  access-control-allow-origin: http://localhost:5173
  access-control-expose-headers: electric-cursor,electric-handle,electric-offset,electric-schema,electric-up-to-date,electric-internal-known-error
  access-control-allow-methods: GET, HEAD, DELETE, OPTIONS
  content-type: application/json; charset=utf-8
  etag: "129354055-1754939152814648:0_0:674770832_0"
  electric-handle: 129354055-1754939152814648
  electric-schema: {"name":{"type":"varchar","max_length":255,"not_null":true},"size":{"type":"varchar","max_length":255},"type":{"type":"varchar","max_length":255}}
  electric-up-to-date: 
  electric-offset: 674770832_0

So, it appears that by default, Electric SQL only uses Vary: accept-encoding, which means that the response will be cached depending on the URL + Accept-Encoding field only, but not on cookie or auth header. (Which is good, I guess, because Auth header is based on jwt tokens, and gets reissued every 60 minutes or so).
Also, the Cache-Control header is set to "public", while MDN recommends "private":

For applications that employ cookies to prevent others from reusing cached personalized content, you should specify Cache-Control: private instead of specifying a cookie for Vary.
The public value has the effect of making the response storable even if the Authorization header is present.

I think I know how to fix this at the proxy level, but perhaps it would be nice to say something in the documentation? Because it looks like it's easy to set up in an insecure manner...

[KyleAMathews]

We do want public as shapes should be cached by anything before your proxy e.g. nginx, a CDN, etc. Your proxy is what separates this inner world to the outer world & it's what should set the vary. I added a PR for the docs #3013

[pasha-omni]

thank you, this is awesome!