The Curious Case of Caching CSRF Tokens

What this post added

This post details the debugging and resolution of an issue where cookie-based caching for anonymous Magento users caused the 'Add to Cart' functionality to fail on the first request. The root cause was identified as Cloudflare's default behavior of stripping `Set-Cookie` headers from cached responses, which prevented Magento from setting the necessary `frontend` cookie. The solution involved configuring Cloudflare's Page Rules to bypass the cache for requests containing specific cookies (`external_no_cache`, `PHPSESSID`, `adminhtml`) while still allowing caching for anonymous users. This enabled static caching of anonymous page views while ensuring dynamic interactions like adding items to the cart worked correctly.