Flarum's cached API takes under 100 ms, uncached >300 ms on fast metal, but most often I see around 700 ms to 3-6 seconds on forums with dozens of extensions enabled. Talking about caching is definitely legit.
Unfortunately, it seems impossible to find out just from HTTP headers if responses are coming for a logged user or guest. In both cases, Flarum sets the session ID in a cookie. As I wrote in another thread, forcing the cache server to query Redis or another source for the session ID status is anti-pattern. If I missed something, I apologize and ask for a straightforward solution.
In doing so, we don't need too. No need to implement ESI right away, although that would be great. Just something like the HTTP header X-User-Type:logged
is sufficient. Only one header if we don't want to deal with ESI and Cache-Control.