Stale-while-revalidate and cache stampede

At exactly T+3600 seconds, your most popular article’s cache entry expires across all edge POPs simultaneously. One thousand users request that page in the next second. Every one of them gets a cache miss. Every one triggers an origin fetch. Your origin sees 1000× normal traffic and starts timing out — and because some of those requests timed out, the CDN stored the 503 response as the new cached entry. Now every user sees a 503 for the next 3600 seconds.

The cache stampede problem

A cache stampede (also called thundering herd) happens when:

1. A popular cached response expires.
2. Many concurrent requests arrive simultaneously after expiry.
3. All miss the cache and each independently fetches from origin.
4. Origin is overwhelmed; some requests time out.
5. The CDN caches the error responses — making things worse.

Without mitigation, the amplification factor is (requests/sec at expiry) × (origin response time). A page receiving 500 req/s with 200 ms origin response time can generate 100 simultaneous in-flight origin requests — 100× normal origin load.

stale-while-revalidate (SWR)

RFC 5861 defines stale-while-revalidate=<seconds>:

Cache-Control: public, max-age=60, stale-while-revalidate=604800

After max-age=60 seconds expire:

• Serve the stale response immediately to every incoming request.
• Send one background revalidation request to origin.
• Cache becomes fresh again after origin responds.
• The staleness window is max-age + stale-while-revalidate = 60 s + 7 days.

All 1000 concurrent users at T+60 still get a response in ~20 ms (stale edge hit), while origin sees exactly one revalidation request. The stampede never happens.

The trade-off: users may see content up to stale-while-revalidate seconds out of date. For a news article body (max-age=300, swr=3600) this means content can be 1 hour stale after max-age expires. For a breaking-news ticker, this is unacceptable — use a short SWR or no SWR.

stale-if-error: graceful degradation on origin failure

RFC 5861 also defines stale-if-error=<seconds>:

Cache-Control: public, max-age=3600, stale-if-error=86400

When origin returns a 5xx or is unreachable, serve the stale cached response for up to stale-if-error seconds (1 day here) rather than returning an error to users. This is the CDN equivalent of a circuit breaker.

Use cases: marketing pages, documentation, article pages — anything where a 1-day-stale version is better than a 503. Not for checkout, payment, or any operation that must reflect real-time state.

The four stampede mitigations