Currently persona sends their include.js with a Cache-Control: max-age=0 and no ETag (at least when requested with Accept-Encoding: gzip, which most browsers/devices will send) It sucks, we want Marketplace to make as few HTTP requests as necessary. There are 2 options here: - Get persona to fix this. There are lots of discussions about this on the mailing list and github issues (start from https://github.com/mozilla/persona/issues/3035) but it seems to have stalled. - Host it ourselves, if that works, being extra careful to stay up to date. We can either fold it into our general include.js or leave it in a separate file, making sure it has a cache-busting query string and far-future expires set.

FYI: I filed https://github.com/mozilla/persona/issues/4105 to send `ETag` when requested with `Accept-Encoding: gzip`

We expect to revamp Persona's APIs and data formats in the next month or two, so hanging onto an old include.js isn't ideal. At the same time, our ability to get changes into production is a bit impaired at the moment (fewer humans, with less time), so it might take a while for us to fix it on our end. Once we get the new APIs / data formats into place, self-caching will be possible, if you can hold out for a few months. Alternatively, I understand that Marketplace plans to switch to Firefox Accounts? It might also be worth just waiting until you can make that move.

Marketplace is one of the sites on the testing list for new versions of persona (as far as I know, CCing Krupa). So, we should be able to host our own .js file and still coordinate with you about any backwards incomapatible changes in a few months. As you noted, we are moving to FxA also "in a few months" so there may not even be a need for the coordination.

As a stopgap solution we could proxy include.js and host it on our CDN. And we'd get ETags for free. FxA we shouldn't wait for IMO.

Tarako is nice and fast and fireplace will move to Firefox Accounts, I don't think its worth doing this.