Application Caching Patterns

Why Application-Level Caching

HTTP caching protects your server from repeat requests for the same URL. Database caching stores query results. But there’s a middle layer — within your application — where expensive computation happens that doesn’t map cleanly to either.

The problem: function calls are expensive. Whether it’s a database query that joins five tables, a third-party API call, a rendered HTML fragment, or a computed permission check — calling it 1000 times when the result doesn’t change is waste.

Query Result Caching

Cache the result of expensive database queries:

class QueryCache {
	constructor(private redis: RedisClient) {}

	async query<T>(key: string, queryFn: () => Promise<T>, ttl = 60): Promise<T> {
		const cached = await this.redis.get(key);
		if (cached) return JSON.parse(cached);

		const result = await queryFn();
		await this.redis.setEx(key, ttl, JSON.stringify(result));
		return result;
	}
}

const qc = new QueryCache(redis);

// Cache expensive aggregate query for 5 minutes
const stats = await qc.query(
	'stats:dashboard:2026-05',
	() =>
		db.query(`
    SELECT
      COUNT(*) AS total_orders,
      SUM(amount) AS revenue,
      AVG(amount) AS avg_order
    FROM orders
    WHERE created_at >= NOW() - INTERVAL '30 days'
  `),
	300
);

Key composition for parameterized queries:

import { stringify } from 'fast-json-stable-stringify';

function queryKey(name: string, params: object): string {
	return `query:${name}:${stringify(params)}`;
}

const users = await qc.query(
	queryKey('users.search', { role: 'admin', page: 1, limit: 20 }),
	() => db.users.search({ role: 'admin', page: 1, limit: 20 }),
	60
);

Session Store

Sessions are a classic cache use case: small, frequently read, tied to a TTL.

import { randomBytes } from 'crypto';

interface Session {
	userId: string;
	roles: string[];
	createdAt: number;
}

class SessionStore {
	private TTL = 86400; // 24 hours

	constructor(private redis: RedisClient) {}

	async create(userId: string, roles: string[]): Promise<string> {
		const sessionId = randomBytes(32).toString('hex');
		const session: Session = { userId, roles, createdAt: Date.now() };
		await this.redis.setEx(`session:${sessionId}`, this.TTL, JSON.stringify(session));
		return sessionId;
	}

	async get(sessionId: string): Promise<Session | null> {
		const raw = await this.redis.get(`session:${sessionId}`);
		return raw ? JSON.parse(raw) : null;
	}

	async touch(sessionId: string): Promise<void> {
		// Reset TTL on each request (sliding expiry)
		await this.redis.expire(`session:${sessionId}`, this.TTL);
	}

	async destroy(sessionId: string): Promise<void> {
		await this.redis.del(`session:${sessionId}`);
	}
}

// Middleware
async function sessionMiddleware(req, res, next): Promise<void> {
	const sessionId = req.cookies?.sessionId;
	if (!sessionId) return next();

	const session = await sessions.get(sessionId);
	if (!session) return next();

	await sessions.touch(sessionId); // sliding expiry
	req.session = session;
	next();
}

Memoization

Cache the result of a pure function keyed by its arguments. Works for in-process or distributed:

// In-process memoization (survives only in this process)
function memoize<TArgs extends unknown[], TReturn>(
	fn: (...args: TArgs) => TReturn,
	keyFn: (...args: TArgs) => string = (...args) => JSON.stringify(args)
): (...args: TArgs) => TReturn {
	const cache = new Map<string, TReturn>();

	return (...args: TArgs): TReturn => {
		const key = keyFn(...args);
		if (cache.has(key)) return cache.get(key)!;

		const result = fn(...args);
		cache.set(key, result);
		return result;
	};
}

// Memoize a permission check
const canAccess = memoize(
	(userId: string, resource: string): boolean => {
		return computePermissions(userId, resource);
	},
	(userId, resource) => `${userId}:${resource}`
);

Async memoization with Redis:

function memoizeAsync<TArgs extends unknown[], TReturn>(
	fn: (...args: TArgs) => Promise<TReturn>,
	options: { ttl: number; keyFn?: (...args: TArgs) => string }
) {
	const { ttl, keyFn = (...args) => JSON.stringify(args) } = options;

	return async (...args: TArgs): Promise<TReturn> => {
		const key = `memo:${fn.name}:${keyFn(...args)}`;

		const cached = await redis.get(key);
		if (cached) return JSON.parse(cached);

		const result = await fn(...args);
		await redis.setEx(key, ttl, JSON.stringify(result));
		return result;
	};
}

const getPermissions = memoizeAsync(async (userId: string) => db.permissions.forUser(userId), {
	ttl: 300,
	keyFn: (userId) => userId
});

Fragment Caching

Cache partial outputs — rendered HTML snippets, partial API payloads — rather than full responses.

// Cache just the expensive part of a response
async function getProductPage(productId: string): Promise<ProductPage> {
	const [product, cachedRelated, cachedReviews] = await Promise.all([
		getProduct(productId), // always fresh
		cache.get(`related:${productId}`) as Promise<Product[] | null>, // cached
		cache.get(`reviews:${productId}`) as Promise<Review[] | null> // cached
	]);

	const related =
		cachedRelated ??
		(await fetchAndCache(
			`related:${productId}`,
			() => getRelatedProducts(productId),
			600 // 10 min — related products change slowly
		));

	const reviews =
		cachedReviews ??
		(await fetchAndCache(
			`reviews:${productId}`,
			() => getRecentReviews(productId),
			60 // 1 min — reviews can change frequently
		));

	return { product, related, reviews };
}

This is more granular than full-response caching — different fragments have different TTLs matching their actual rate of change.

Computed Values and Aggregations

Pre-compute and cache values that are expensive to derive on demand:

class Leaderboard {
	private CACHE_KEY = 'leaderboard:top100';
	private TTL = 60; // rebuild every minute

	async getTop100(): Promise<LeaderboardEntry[]> {
		const cached = await redis.get(this.CACHE_KEY);
		if (cached) return JSON.parse(cached);

		// Expensive: scans millions of user records
		const entries = await db.query(`
      SELECT user_id, SUM(points) AS total
      FROM point_events
      WHERE created_at > NOW() - INTERVAL '7 days'
      GROUP BY user_id
      ORDER BY total DESC
      LIMIT 100
    `);

		await redis.setEx(this.CACHE_KEY, this.TTL, JSON.stringify(entries));
		return entries;
	}

	async addPoints(userId: string, points: number): Promise<void> {
		await db.pointEvents.insert({ userId, points });
		// Don't invalidate — let TTL handle it
		// Leaderboard can be 1 minute stale — that's fine
	}
}

When real-time accuracy matters more, maintain the leaderboard incrementally:

// Use a sorted set — O(log N) updates, O(1) rank queries
async function addPoints(userId: string, points: number): Promise<void> {
	await redis.zIncrBy('leaderboard:live', points, userId);
}

async function getTop100(): Promise<Array<{ userId: string; score: number }>> {
	return redis.zRangeWithScores('leaderboard:live', 0, 99, { REV: true });
}

Deduplication Cache

Prevent processing the same event twice (idempotency):

class IdempotencyCache {
	async processOnce<T>(
		idempotencyKey: string,
		handler: () => Promise<T>,
		ttl = 86400 // 24h
	): Promise<T> {
		const existingResult = await redis.get(`idempotent:${idempotencyKey}`);
		if (existingResult) {
			return JSON.parse(existingResult); // return cached result
		}

		const result = await handler();
		await redis.setEx(`idempotent:${idempotencyKey}`, ttl, JSON.stringify(result));
		return result;
	}
}

// Webhook handler — safe to retry
app.post('/webhooks/payment', async (req, res) => {
	const { idempotencyKey, payload } = req.body;

	const result = await idempotencyCache.processOnce(idempotencyKey, () => processPayment(payload));

	res.json(result);
});

Negative Caching

Cache the fact that something doesn’t exist, preventing repeated DB lookups for non-existent keys:

const CACHE_NULL = '__NULL__';

async function getUser(id: string): Promise<User | null> {
	const cached = await redis.get(`user:${id}`);

	if (cached === CACHE_NULL) return null; // cached non-existence
	if (cached) return JSON.parse(cached);

	const user = await db.users.findById(id);

	if (!user) {
		// Cache the miss for 60s — prevents DB hammering for bogus IDs
		await redis.setEx(`user:${id}`, 60, CACHE_NULL);
		return null;
	}

	await redis.setEx(`user:${id}`, 300, JSON.stringify(user));
	return user;
}