diff --git a/backend/src/Squidex.Domain.Users.MongoDb/MongoKeyStore.cs b/backend/src/Squidex.Domain.Users.MongoDb/MongoKeyStore.cs
index 8faec7d51..db6b2873d 100644
--- a/backend/src/Squidex.Domain.Users.MongoDb/MongoKeyStore.cs
+++ b/backend/src/Squidex.Domain.Users.MongoDb/MongoKeyStore.cs
@@ -36,6 +36,7 @@ namespace Squidex.Domain.Users.MongoDb
         public async Task<SigningCredentials> GetSigningCredentialsAsync()
         {
             var (_, key) = await GetOrCreateKeyAsync();
+            // SignatureProvider signatureProvider = key.CryptoProviderFactory.CreateForVerifying(key, key.Al);
 
             return key;
         }
diff --git a/backend/src/Squidex.Web/Pipeline/CachingFilter.cs b/backend/src/Squidex.Web/Pipeline/CachingFilter.cs
index 139c9a67f..4e7e101ce 100644
--- a/backend/src/Squidex.Web/Pipeline/CachingFilter.cs
+++ b/backend/src/Squidex.Web/Pipeline/CachingFilter.cs
@@ -13,6 +13,7 @@ using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.Extensions.Options;
 using Microsoft.Net.Http.Headers;
 using Squidex.Infrastructure;
+using Squidex.Infrastructure.Security;
 
 namespace Squidex.Web.Pipeline
 {
@@ -35,11 +36,19 @@ namespace Squidex.Web.Pipeline
             var httpContext = context.HttpContext;
 
             cachingManager.Start(httpContext);
-            cachingManager.AddHeader(HeaderNames.Authorization);
 
-            var resultContext = await next();
+            cachingManager.AddHeader("Auth-State");
 
-            cachingManager.Finish(httpContext, cachingOptions.MaxSurrogateKeys);
+            if (!string.IsNullOrWhiteSpace(httpContext.User.OpenIdSubject()))
+            {
+                cachingManager.AddHeader(HeaderNames.Authorization);
+            }
+            else if (!string.IsNullOrWhiteSpace(httpContext.User.OpenIdClientId()))
+            {
+                cachingManager.AddHeader("Auth-ClientId");
+            }
+
+            var resultContext = await next();
 
             if (httpContext.Response.Headers.TryGetString(HeaderNames.ETag, out var etag))
             {
@@ -58,6 +67,8 @@ namespace Squidex.Web.Pipeline
                     resultContext.Result = new StatusCodeResult(304);
                 }
             }
+
+            cachingManager.Finish(httpContext, cachingOptions.MaxSurrogateKeys);
         }
     }
 }
diff --git a/backend/tests/Squidex.Web.Tests/Pipeline/CachingFilterTests.cs b/backend/tests/Squidex.Web.Tests/Pipeline/CachingFilterTests.cs
index f1c03d01a..c281cce99 100644
--- a/backend/tests/Squidex.Web.Tests/Pipeline/CachingFilterTests.cs
+++ b/backend/tests/Squidex.Web.Tests/Pipeline/CachingFilterTests.cs
@@ -7,6 +7,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Security.Claims;
 using System.Threading.Tasks;
 using FakeItEasy;
 using Microsoft.AspNetCore.Http;
@@ -17,6 +18,7 @@ using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.Options;
 using Microsoft.Extensions.Primitives;
 using Microsoft.Net.Http.Headers;
+using Squidex.Infrastructure.Security;
 using Xunit;
 
 namespace Squidex.Web.Pipeline
@@ -63,7 +65,31 @@ namespace Squidex.Web.Pipeline
         {
             await sut.OnActionExecutionAsync(executingContext, Next());
 
-            Assert.Equal("Authorization", httpContext.Response.Headers[HeaderNames.Vary]);
+            Assert.Equal("Auth-State", httpContext.Response.Headers[HeaderNames.Vary]);
+        }
+
+        [Fact]
+        public async Task Should_append_authorization_as_header_when_user_has_subject()
+        {
+            var identity = (ClaimsIdentity)httpContext.User.Identity;
+
+            identity.AddClaim(new Claim(OpenIdClaims.Subject, "my-id"));
+
+            await sut.OnActionExecutionAsync(executingContext, Next());
+
+            Assert.Equal("Auth-State,Authorization", httpContext.Response.Headers[HeaderNames.Vary]);
+        }
+
+        [Fact]
+        public async Task Should_append_client_id_as_header_when_user_has_client_but_no_subject()
+        {
+            var identity = (ClaimsIdentity)httpContext.User.Identity;
+
+            identity.AddClaim(new Claim(OpenIdClaims.ClientId, "my-client"));
+
+            await sut.OnActionExecutionAsync(executingContext, Next());
+
+            Assert.Equal("Auth-State,Auth-ClientId", httpContext.Response.Headers[HeaderNames.Vary]);
         }
 
         [Fact]
@@ -76,7 +102,7 @@ namespace Squidex.Web.Pipeline
                 return Task.FromResult(executedContext);
             });
 
-            Assert.Equal("Authorization", httpContext.Response.Headers[HeaderNames.Vary]);
+            Assert.Equal("Auth-State", httpContext.Response.Headers[HeaderNames.Vary]);
         }
 
         [Fact]
@@ -89,7 +115,7 @@ namespace Squidex.Web.Pipeline
                 return Task.FromResult(executedContext);
             });
 
-            Assert.Equal("Authorization", httpContext.Response.Headers[HeaderNames.Vary]);
+            Assert.Equal("Auth-State", httpContext.Response.Headers[HeaderNames.Vary]);
         }
 
         [Fact]
@@ -102,7 +128,7 @@ namespace Squidex.Web.Pipeline
                 return Task.FromResult(executedContext);
             });
 
-            Assert.Equal("Authorization,X-Header", httpContext.Response.Headers[HeaderNames.Vary]);
+            Assert.Equal("Auth-State,X-Header", httpContext.Response.Headers[HeaderNames.Vary]);
         }
 
         [Fact]