I'm using asp.net MVC, so I did this in my controller
if (User.Identity.IsAuthenticated) {
Response.Cache.SetCacheability(HttpCacheability.NoCache);
Response.Cache.SetExpires(DateTime.Now.AddMinutes(-1));
Response.Cache.SetNoStore();
Response.Cache.SetNoServerCaching();
}
else {
Response.Cache.VaryByParams["id"] = true; // this is a details page
Response.Cache.SetVaryByCustom("username"); // see global.asax.cs GetVaryByCustomString()
Response.Cache.SetExpires(DateTime.Now.AddSeconds(60));
Response.Cache.SetCacheability(HttpCacheability.Server);
Response.Cache.SetValidUntilExpires(true);
}
The reason I did it this way (instead of declaratively) was I also needed the ability to turn it on and off via configuration (not shown here, but there's an extra check in the if for my config variable).
You still need the vary by username, else you'll not execute this code when a logged in user appears. My GetVaryByCustomString function returns "anonymous" when not authenticated or the users name when available.