The cache contexts used by Group all relied on being able to retrieve a group entity from the URL. This had several drawbacks and potentially even security issues. The main ones being:
- We could not cache lists of groups because there was no group in the URL
- We could therefore not properly cache JSON API responses when used with Group
- We could not cache access results properly because there is no certainty that the group to check access for came from the URL
New cache contexts
This has been fixed by the introduction of three new cache contexts:
- route.group: To be used when the result varies by the group in the URL
- user.group_permissions: To be used when the result varies by a user's overall group permissions (for the whole site)
- user.is_group_member:%group_id: To be used when showing something that relies on whether a user belongs to a specific group
Please read the code and docblock for these cache contexts thoroughly before implementing them.
Deprecated cache contexts
The following contexts have been deprecated and all their implementations in Group have been replaced with the new cache contexts:
- group
- group_membership
- group_membership.audience
- group_membership.roles
Please update your code to no longer use these cache contexts.
Removed cache contexts
The group_membership.roles.permissions cache context has been removed because it was deemed unsafe. Please read the separate change record on this subject.
Further reading
Please also read the following documentation article when dealing with a very dynamic website (lots of groups, group types, etc.):
https://www.drupal.org/docs/8/modules/group/turning-off-caching-when-it-...
