Important Caching Strategies: How to Create Resilient Caching in Symfony

The Symfony Cache component is often the most under-utilized tool in a developer’s arsenal. Most implementations stop at “install Redis” and wrap a few database calls in a $cache->get() closure. While functional, this barely scratches the surface of what the component can do in high-throughput, distributed environments. $cache->get() In Symfony 7.3, the Cache component is not just a key-value store; it is a sophisticated system capable of tiered architecture, probabilistic stampede protection, and transparent encryption. This article explores important caching strategies that solve expensive architectural problems: latency, concurrency (thundering herds), security (GDPR), and distributed invalidation. latency concurrency security GDPR distributed invalidation The Architecture of Latency: Tiered (Chain) Caching In microservice architectures or high-traffic monoliths, a network call to Redis (typically 1–3ms) can eventually become a bottleneck compared to local memory (nanoseconds). However, local memory (APCu) is volatile and doesn’t share state across pods/servers. The solution is a Chain Cache, effectively acting as an L1/L2 CPU cache for your application. L1 is local (APCu), L2 is shared (Redis). Chain Cache L1/L2 CPU L1 is local (APCu) L2 is shared (Redis) The Configuration We will configure a pool that reads from APCu first. If it misses, it reads from Redis, then populates APCu. composer require symfony/cache symfony/orm-pack redis composer require symfony/cache symfony/orm-pack redis Configuration (config/packages/cache.yaml): config/packages/cache.yaml framework: cache: # Prefix all keys to avoid collisions in shared Redis instances prefix_seed: '%env(APP_SECRET)%' pools: # L2 Cache: Redis (Shared) cache.redis: adapter: cache.adapter.redis provider: 'redis://%env(REDIS_HOST)%:6379' default_lifetime: 3600 # 1 hour # L1 Cache: APCu (Local Memory) cache.apcu: adapter: cache.adapter.apcu default_lifetime: 60 # Short TTL to prevent stale local data # The Chain: L1 + L2 cache.layered: adapter: cache.adapter.chain provider: [cache.apcu, cache.redis] framework: cache: # Prefix all keys to avoid collisions in shared Redis instances prefix_seed: '%env(APP_SECRET)%' pools: # L2 Cache: Redis (Shared) cache.redis: adapter: cache.adapter.redis provider: 'redis://%env(REDIS_HOST)%:6379' default_lifetime: 3600 # 1 hour # L1 Cache: APCu (Local Memory) cache.apcu: adapter: cache.adapter.apcu default_lifetime: 60 # Short TTL to prevent stale local data # The Chain: L1 + L2 cache.layered: adapter: cache.adapter.chain provider: [cache.apcu, cache.redis] Usage Inject the specific pool using the Target attribute. namespace App\Service; use Symfony\Component\DependencyInjection\Attribute\Target; use Symfony\Contracts\Cache\CacheInterface; use Symfony\Contracts\Cache\ItemInterface; class DashboardService { public function __construct( #[Target('cache.layered')] private readonly CacheInterface $cache ) {} public function getStats(): array { // 1. Checks APCu. Hit? Return. // 2. Miss? Checks Redis. Hit? Populate APCu & Return. // 3. Miss? Run Callback. Populate Redis & APCu. return $this->cache->get('stats_v1', function (ItemInterface $item): array { $item->expiresAfter(3600); return $this->computeHeavyStats(); }); } private function computeHeavyStats(): array { // Simulation of heavy work return ['users' => 10500, 'revenue' => 50000]; } } namespace App\Service; use Symfony\Component\DependencyInjection\Attribute\Target; use Symfony\Contracts\Cache\CacheInterface; use Symfony\Contracts\Cache\ItemInterface; class DashboardService { public function __construct( #[Target('cache.layered')] private readonly CacheInterface $cache ) {} public function getStats(): array { // 1. Checks APCu. Hit? Return. // 2. Miss? Checks Redis. Hit? Populate APCu & Return. // 3. Miss? Run Callback. Populate Redis & APCu. return $this->cache->get('stats_v1', function (ItemInterface $item): array { $item->expiresAfter(3600); return $this->computeHeavyStats(); }); } private function computeHeavyStats(): array { // Simulation of heavy work return ['users' => 10500, 'revenue' => 50000]; } } Verification Clear cache: bin/console cache:pool:clear cache.layered Request the page Check Redis (CLI): KEYS * (You will see the key). Check APCu (Web Panel): You will see the key. Disconnect Redis. The app will continue to serve from APCu for 60 seconds. Clear cache: bin/console cache:pool:clear cache.layered Clear cache: Request the page Check Redis (CLI): KEYS * (You will see the key). Check Redis (CLI): Check APCu (Web Panel): You will see the key. Check APCu (Web Panel): Disconnect Redis. The app will continue to serve from APCu for 60 seconds. Solving the Thundering Herd: Probabilistic Early Expiration The “Cache Stampede” (or Thundering Herd) occurs when a hot cache key expires. Suddenly, 1,000 concurrent requests miss the cache simultaneously and hit your database to compute the same value. The database crashes. Symfony solves this without complex locking mechanisms (like Semaphore) by using Probabilistic Early Expiration. without Probabilistic Early Expiration How It Works Instead of expiring exactly at 12:00:00, the cache claims to be empty slightly before the expiration, but only for some requests. The closer to expiration, the higher the probability of a miss. One lucky request recomputes the value while others are served the “stale” (but valid) data. The Implementation You don’t need a new configuration; you need to utilize the $beta parameter in the contract. $beta // $beta of 1.0 is standard. // Higher = recompute earlier. // 0 = disable. // INF = force recompute. $beta = 1.0; $value = $this->cache->get('stock_ticker_aapl', function (ItemInterface $item) { // The item ACTUALLY expires in 1 hour $item->expiresAfter(3600); return $this->stockApi->fetchPrice('AAPL'); }, $beta); // $beta of 1.0 is standard. // Higher = recompute earlier. // 0 = disable. // INF = force recompute. $beta = 1.0; $value = $this->cache->get('stock_ticker_aapl', function (ItemInterface $item) { // The item ACTUALLY expires in 1 hour $item->expiresAfter(3600); return $this->stockApi->fetchPrice('AAPL'); }, $beta); Mathematical Verification There is no CLI command to “prove” probability, but you can log the recomputations. Set $item->expiresAfter(10). Create a loop that hits this cache key every 100ms. Observe that the callback is triggered before 10 seconds have passed and usually only once, ensuring your backend is protected. Set $item->expiresAfter(10). $item->expiresAfter(10) Create a loop that hits this cache key every 100ms. Observe that the callback is triggered before 10 seconds have passed and usually only once, ensuring your backend is protected. The “Black Box”: Transparent Encryption with Sodium Caching Personal Identifiable Information (PII) in Redis is a GDPR/security risk. If an attacker dumps your Redis memory, they have the data. Personal Identifiable Information GDPR/security risk Symfony allows you to wrap your cache adapter in a Marshaller. We will use the SodiumMarshaller to transparently encrypt data before it leaves PHP and decrypt it upon retrieval. Marshaller SodiumMarshaller Ensure libsodium is installed and the extension is enabled in PHP 8.x. libsodium installed enabled Configuration We need to decorate the default marshaller. We will use a “Deflate” marshaller (to compress data) wrapped inside a “Sodium” marshaller (to encrypt it). Deflate Sodium #config/services.yaml services: # 1. Generate a key: php -r "echo bin2hex(random_bytes(SODIUM_CRYPTO_SECRETBOX_KEYBYTES));" # Store this in .env.local: CACHE_DECRYPTION_KEY=your_hex_key # 2. Define the Marshaller Service app.cache.marshaller.secure: class: Symfony\Component\Cache\Marshaller\SodiumMarshaller arguments: - ['%env(hex2bin:CACHE_DECRYPTION_KEY)%'] - '@app.cache.marshaller.deflate' # Chain encryption OVER compression app.cache.marshaller.deflate: class: Symfony\Component\Cache\Marshaller\DeflateMarshaller arguments: ['@default_marshaller'] default_marshaller: class: Symfony\Component\Cache\Marshaller\DefaultMarshaller # 3. Use the custom marshaller in your cache adapter Symfony\Component\Cache\Adapter\RedisAdapter: arguments: $marshaller: '@app.cache.marshaller.secure' #config/services.yaml services: # 1. Generate a key: php -r "echo bin2hex(random_bytes(SODIUM_CRYPTO_SECRETBOX_KEYBYTES));" # Store this in .env.local: CACHE_DECRYPTION_KEY=your_hex_key # 2. Define the Marshaller Service app.cache.marshaller.secure: class: Symfony\Component\Cache\Marshaller\SodiumMarshaller arguments: - ['%env(hex2bin:CACHE_DECRYPTION_KEY)%'] - '@app.cache.marshaller.deflate' # Chain encryption OVER compression app.cache.marshaller.deflate: class: Symfony\Component\Cache\Marshaller\DeflateMarshaller arguments: ['@default_marshaller'] default_marshaller: class: Symfony\Component\Cache\Marshaller\DefaultMarshaller # 3. Use the custom marshaller in your cache adapter Symfony\Component\Cache\Adapter\RedisAdapter: arguments: $marshaller: '@app.cache.marshaller.secure' #config/packages/cache.yaml framework: cache: pools: cache.secure: adapter: cache.adapter.redis # We need to point the 'default_marshaller' of this pool to our secure one? # Actually, defining the adapter service globally as we did above # is the cleanest way if you want ALL redis caches encrypted. # Alternatively, use the provider syntax: # For specific pool encryption, we often have to define the service manually # or use a factory because framework.yaml config is limited for complex DI. #config/packages/cache.yaml framework: cache: pools: cache.secure: adapter: cache.adapter.redis # We need to point the 'default_marshaller' of this pool to our secure one? # Actually, defining the adapter service globally as we did above # is the cleanest way if you want ALL redis caches encrypted. # Alternatively, use the provider syntax: # For specific pool encryption, we often have to define the service manually # or use a factory because framework.yaml config is limited for complex DI. Refined Approach for Symfony (Best Practice): Instead of overriding the global adapter, define the pool service explicitly to inject the marshaller. # config/services.yaml services: app.cache.secure_pool: class: Symfony\Component\Cache\Adapter\RedisAdapter arguments: $redis: 'redis://%env(REDIS_HOST)%:6379' $marshaller: '@app.cache.marshaller.secure' tags: ['cache.pool'] # config/services.yaml services: app.cache.secure_pool: class: Symfony\Component\Cache\Adapter\RedisAdapter arguments: $redis: 'redis://%env(REDIS_HOST)%:6379' $marshaller: '@app.cache.marshaller.secure' tags: ['cache.pool'] Usage public function storeUserAddress(int $userId, string $address): void { // This data is compressed and encrypted in Redis $cacheItem = $this->securePool->getItem('user_addr_' . $userId); $cacheItem->set($address); $this->securePool->save($cacheItem); } public function storeUserAddress(int $userId, string $address): void { // This data is compressed and encrypted in Redis $cacheItem = $this->securePool->getItem('user_addr_' . $userId); $cacheItem->set($address); $this->securePool->save($cacheItem); } Verification Save data to the cache. Connect to Redis via CLI: redis-cli. GET the key. Result: You will see binary garbage (encrypted string), not the plaintext address. Retrieve it via PHP: You get the plaintext address. Save data to the cache. Connect to Redis via CLI: redis-cli. redis-cli GET the key. GET Result: You will see binary garbage (encrypted string), not the plaintext address. Result: Retrieve it via PHP: You get the plaintext address. Retrieve it via PHP: Distributed Invalidation: Tags & Messenger The hardest problem in computer science is cache invalidation. It gets harder when you have 5 web servers (pods). If Server A updates a product, Server B’s APCu cache still holds the old product. We solve this by broadcasting invalidation messages via Symfony Messenger. The Strategy Write to Redis (shared). Cache locally in APCu (for speed). When data changes, dispatch a message to the bus. All servers consume the message and clear their local APCu for that specific tag. Write to Redis (shared). Cache locally in APCu (for speed). When data changes, dispatch a message to the bus. All servers consume the message and clear their local APCu for that specific tag. Configuration composer require symfony/messenger composer require symfony/messenger We need a transport that supports “Pub/Sub” (Fanout), so every server gets the message. Redis streams or RabbitMQ Fanout exchanges work. #config/packages/messenger.yaml framework: messenger: transports: # Use a fanout exchange so ALL pods receive the message cache_invalidation: dsn: '%env(MESSENGER_TRANSPORT_DSN)%' options: exchange: type: fanout name: cache_invalidation_fanout #config/packages/messenger.yaml framework: messenger: transports: # Use a fanout exchange so ALL pods receive the message cache_invalidation: dsn: '%env(MESSENGER_TRANSPORT_DSN)%' options: exchange: type: fanout name: cache_invalidation_fanout The Code 1. The Invalidation Message 1. The Invalidation Message namespace App\Message; final readonly class InvalidateTagsMessage { public function __construct( public array $tags ) {} } namespace App\Message; final readonly class InvalidateTagsMessage { public function __construct( public array $tags ) {} } 2. The Handler This handler runs on every server. 2. The Handler This handler runs on every server. namespace App\MessageHandler; use App\Message\InvalidateTagsMessage; use Symfony\Component\Messenger\Attribute\AsMessageHandler; use Symfony\Contracts\Cache\TagAwareCacheInterface; use Symfony\Component\DependencyInjection\Attribute\Target; #[AsMessageHandler] final readonly class InvalidateTagsHandler { public function __construct( #[Target('cache.layered')] // Target our Chain Cache private TagAwareCacheInterface $cache ) {} public function __invoke(InvalidateTagsMessage $message): void { // This invalidates the local APCu layer AND the shared Redis layer $this->cache->invalidateTags($message->tags); } } namespace App\MessageHandler; use App\Message\InvalidateTagsMessage; use Symfony\Component\Messenger\Attribute\AsMessageHandler; use Symfony\Contracts\Cache\TagAwareCacheInterface; use Symfony\Component\DependencyInjection\Attribute\Target; #[AsMessageHandler] final readonly class InvalidateTagsHandler { public function __construct( #[Target('cache.layered')] // Target our Chain Cache private TagAwareCacheInterface $cache ) {} public function __invoke(InvalidateTagsMessage $message): void { // This invalidates the local APCu layer AND the shared Redis layer $this->cache->invalidateTags($message->tags); } } 3. The Service Triggering the Change 3. The Service Triggering the Change namespace App\Service; use App\Message\InvalidateTagsMessage; use Symfony\Component\Messenger\MessageBusInterface; use Symfony\Contracts\Cache\TagAwareCacheInterface; class ProductService { public function __construct( private TagAwareCacheInterface $cache, private MessageBusInterface $bus ) {} public function updateProduct(int $id, array $data): void { // 1. Update Database... // 2. Invalidate // We do NOT call $cache->invalidateTags() directly here. // Because that would only clear THIS server's APCu and the shared Redis. // Other servers would remain stale. $this->bus->dispatch(new InvalidateTagsMessage(["product_{$id}"])); } } namespace App\Service; use App\Message\InvalidateTagsMessage; use Symfony\Component\Messenger\MessageBusInterface; use Symfony\Contracts\Cache\TagAwareCacheInterface; class ProductService { public function __construct( private TagAwareCacheInterface $cache, private MessageBusInterface $bus ) {} public function updateProduct(int $id, array $data): void { // 1. Update Database... // 2. Invalidate // We do NOT call $cache->invalidateTags() directly here. // Because that would only clear THIS server's APCu and the shared Redis. // Other servers would remain stale. $this->bus->dispatch(new InvalidateTagsMessage(["product_{$id}"])); } } The #[Cacheable] Attribute Instead of writing $cache->get() boilerplate in every service method, let’s create a PHP 8 Attribute that handles caching automatically using the Decorator Pattern or Event Subscription. $cache->get() PHP 8 Attribute Decorator Pattern Event Subscription Below is a clean implementation using a Kernel::CONTROLLER_ARGUMENTS listener, which is efficient and easy to reason about. Kernel::CONTROLLER_ARGUMENTS The Attribute The Attribute namespace App\Attribute; use Attribute; #[Attribute(Attribute::TARGET_METHOD)] final readonly class Cacheable { public function __construct( public string $pool = 'cache.app', public int $ttl = 3600, public ?string $key = null ) {} } namespace App\Attribute; use Attribute; #[Attribute(Attribute::TARGET_METHOD)] final readonly class Cacheable { public function __construct( public string $pool = 'cache.app', public int $ttl = 3600, public ?string $key = null ) {} } The Event Subscriber This listener intercepts controller calls, checks for the attribute, and attempts to serve from cache. This simple implementation assumes the controller returns a generic serializable response (like JSON or an Array). For Response objects, serialization needs care. This simple implementation assumes the controller returns a generic serializable response (like JSON or an Array). For Response objects, serialization needs care. namespace App\EventSubscriber; use App\Attribute\Cacheable; use Symfony\Component\EventDispatcher\EventSubscriberInterface; use Symfony\Component\HttpKernel\Event\ControllerEvent; use Symfony\Component\HttpKernel\KernelEvents; use Symfony\Component\DependencyInjection\ServiceLocator; use Symfony\Contracts\Cache\ItemInterface; class CacheableSubscriber implements EventSubscriberInterface { public function __construct( private ServiceLocator $cachePools // Inject locator to find pools dynamically ) {} public static function getSubscribedEvents(): array { return [ // High priority to catch request before execution KernelEvents::CONTROLLER => ['onKernelController', 10], ]; } public function onKernelController(ControllerEvent $event): void { $controller = $event->getController(); // Handle array callables [$object, 'method'] if (is_array($controller)) { $method = new \ReflectionMethod($controller[0], $controller[1]); } elseif (is_object($controller) && is_callable($controller)) { $method = new \ReflectionMethod($controller, '__invoke'); } else { return; } $attributes = $method->getAttributes(Cacheable::class); if (empty($attributes)) { return; } /** @var Cacheable $cacheable */ $cacheable = $attributes[0]->newInstance(); if (!$this->cachePools->has($cacheable->pool)) { return; } $pool = $this->cachePools->get($cacheable->pool); // Generate a key based on Controller Class + Method + Request Params // This is a simplified key generation strategy $request = $event->getRequest(); $cacheKey = $cacheable->key ?? 'ctrl_' . md5($request->getUri()); // We cannot easily "skip" the controller execution inside a Listener // using the Cache Contract pattern nicely without replacing the controller. // // For a TRULY robust attribute implementation, one should use // a "Service Decorator" logic, but for Controllers, we can replace the // controller callable with a closure that wraps the cache logic. $originalController = $event->getController(); $newController = function() use ($pool, $cacheKey, $cacheable, $originalController, $request) { return $pool->get($cacheKey, function (ItemInterface $item) use ($cacheable, $originalController, $request) { $item->expiresAfter($cacheable->ttl); // Execute the original controller // Note: We need to manually resolve arguments or pass the request // This part is tricky in raw PHP. // In Symfony we can simply execute the original callable // IF we have the resolved arguments. // SIMPLIFICATION for article: // Assuming controller takes Request object or no args return $originalController($request); }); }; $event->setController($newController); } } namespace App\EventSubscriber; use App\Attribute\Cacheable; use Symfony\Component\EventDispatcher\EventSubscriberInterface; use Symfony\Component\HttpKernel\Event\ControllerEvent; use Symfony\Component\HttpKernel\KernelEvents; use Symfony\Component\DependencyInjection\ServiceLocator; use Symfony\Contracts\Cache\ItemInterface; class CacheableSubscriber implements EventSubscriberInterface { public function __construct( private ServiceLocator $cachePools // Inject locator to find pools dynamically ) {} public static function getSubscribedEvents(): array { return [ // High priority to catch request before execution KernelEvents::CONTROLLER => ['onKernelController', 10], ]; } public function onKernelController(ControllerEvent $event): void { $controller = $event->getController(); // Handle array callables [$object, 'method'] if (is_array($controller)) { $method = new \ReflectionMethod($controller[0], $controller[1]); } elseif (is_object($controller) && is_callable($controller)) { $method = new \ReflectionMethod($controller, '__invoke'); } else { return; } $attributes = $method->getAttributes(Cacheable::class); if (empty($attributes)) { return; } /** @var Cacheable $cacheable */ $cacheable = $attributes[0]->newInstance(); if (!$this->cachePools->has($cacheable->pool)) { return; } $pool = $this->cachePools->get($cacheable->pool); // Generate a key based on Controller Class + Method + Request Params // This is a simplified key generation strategy $request = $event->getRequest(); $cacheKey = $cacheable->key ?? 'ctrl_' . md5($request->getUri()); // We cannot easily "skip" the controller execution inside a Listener // using the Cache Contract pattern nicely without replacing the controller. // // For a TRULY robust attribute implementation, one should use // a "Service Decorator" logic, but for Controllers, we can replace the // controller callable with a closure that wraps the cache logic. $originalController = $event->getController(); $newController = function() use ($pool, $cacheKey, $cacheable, $originalController, $request) { return $pool->get($cacheKey, function (ItemInterface $item) use ($cacheable, $originalController, $request) { $item->expiresAfter($cacheable->ttl); // Execute the original controller // Note: We need to manually resolve arguments or pass the request // This part is tricky in raw PHP. // In Symfony we can simply execute the original callable // IF we have the resolved arguments. // SIMPLIFICATION for article: // Assuming controller takes Request object or no args return $originalController($request); }); }; $event->setController($newController); } } You have to register your cache pools in a ServiceLocator for the Subscriber to access them dynamically. register ServiceLocator Subscriber The code above demonstrates modifying the Kernel execution flow. Ideally, for services, you would use #[AsDecorator] on the service definition, but for Controllers, intercepting the event is the Symfony way. Kernel execution flow #[AsDecorator] Conclusion Implementing CacheInterface is easy; architecting a caching strategy that survives network partitions, GDPR audits, and Black Friday traffic spikes is a discipline. CacheInterface GDPR Black Friday traffic The strategies outlined here — Chain Caching for latency, Probabilistic Expiration for concurrency, Sodium Encryption for security, and Messenger-based Invalidation for consistency — move your application away from fragile optimizations and toward robust engineering. Symfony provides these primitives out of the box, allowing us to solve complex distributed system problems without introducing heavy third-party infrastructure. Chain Caching Probabilistic Expiration Sodium Encryption Messenger-based Invalidation Stop treating your cache as a temporary dumping ground. Treat it as a critical, secured layer of your data persistence strategy. Let’s Continue the Discussion High-performance PHP architecture is a constantly evolving landscape. If you are refactoring a legacy monolith or designing a distributed system in Symfony, I’d love to hear about the challenges you are facing. Have you implemented a custom Marshaller for specific compliance needs? How are you handling cache invalidation across multi-region deployments? Reach out to me directly on LinkedIn. Let’s geek out over architecture, share war stories, and build better software.