Why a Cache Can End Up "L1 Read-Only, No Redis Reads or Writes"
Reading the MultiLevelCache#isL1Only source, it is easy to wonder: ordinary caches only come in "L1+L2 two-level" and "L2-only" (pure Redis mode) forms — why does an "L1-only" form exist?
It is not a normal form of the ordinary cache but a safety downgrade for sensitive caches. When a cache name hits the sensitive list (secure: prefix or secureNames config) and platform data encryption is disabled, sensitive data is forbidden to be written to Redis in plaintext; in that case:
- Write side: writes go to the local L1 memory only, never to Redis;
- Read side: not even L2 is queried — reads fall straight through and reload the method.
Skipping L2 on reads is a fail-safe design — Redis may hold three kinds of dirty data: ① ciphertext left over from encryption being enabled and then disabled (currently undecryptable); ② historical data written in plaintext before encryption was enabled (unprotected); ③ ciphertext written by nodes with inconsistent key versions (decryption fails). Falling through and re-querying is better than returning wrong data as a cache hit.
Complete cache behavior matrix:
| Cache type | Condition | Read behavior |
|---|---|---|
| Ordinary cache | enabled=true, l1.enabled=true | L1 → L2 |
| Ordinary cache | enabled=true, l1.enabled=false | L2 only (pure Redis mode) |
| Ordinary cache | enabled=false | NoOp passthrough |
| Sensitive cache | data encryption enabled | L1 → L2 (L2 values encrypted as a whole with AES-GCM) |
| Sensitive cache | data encryption disabled | L1 only (this entry; safety downgrade) |
| Sensitive cache | encryption disabled + l1.enabled=false | full passthrough (effectively no caching) |
Once data encryption is enabled, sensitive caches automatically return to the L1+L2 two-level form (only the L2 value is ciphertext). If this downgrade branch is hit at application startup, the logs emit a WARN saying that sensitive caches use only the local L1 and do not write Redis because data encryption is not enabled.
For the sensitive-cache list and how to configure data encryption, see Configuration - Cache Settings and Data Encryption.