title: Caching API requests with JWT auth
body: <p>I have been trying to figure out if it is possible to cache requests that require JWT auth and checking token contents.</p>
  
  <p>Current setup:</p>
  
  <ul>
  <li>PHP API</li>
  <li>Nginx serving requests</li>
  </ul>
  
  <p>Software I have been exploring:</p>
  
  <ul>
  <li>Nginx</li>
  <li>Varnish</li>
  </ul>
  
  <p>Token contents:</p>
  
  <ul>
  <li>sub</li>
  <li>iss... (regular JWT contents)</li>
  <li>userGroupID</li>
  </ul>
  
  <p>I have some shared content for users and some is personal. So I would like to be able to cache requests to some of the endpoints. Without even calling PHP, when data is available in the cache.</p>
  
  <p>Let's say we have user groups and groups own cars. I would like to be able to authenticate and cache request to following endpoint:</p>
  
  <pre><code>https://myapi.example.com/groups/{groupID}/cars
  </code></pre>
  
  <p>To authenticate this request caching software would have to be able to compare the {groupID} to the groupID that is in the token. But afaik Varnish can only validate token, but can it check that token groupID matches the groupID in the URL?</p>
  
  <p>Nginx has some JWT capabilities, but could not find anything here to achieve that:
  <a href="https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html" rel="nofollow noreferrer">https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html</a></p>
  
  <p>Is there any other software that could achive this? Right now I am considering going back to caching stuff in PHP. Checking tokens there and using memcached or something else to cache data.</p>