I'm creating a module which interacts with an external API that handles authentication and completely bypasses the Drupal authentication system. This means that users logged-in from the API side are seen as anonymous users. The module utilizes the
PrivateTempStore class to store user sessions. This works as expected.
At the moment, any user session sensitive blocks or pages that my module outputs are set to have a maximum cache lifetime of zero to ensure that the user's account page is not cached.
Is this the correct approach, or should I disable the Internal Page Cache module, which specifically targets anonymous users?
The site will be hosted on the Acquia platform; Varnish will be likely used.