+1 that this is currently an issue I think, and we should address it with some VCL changes...

1. In static-hash.inc.vcl.erb, we exclude the hostname from hashes on ^/(w/)?static, because we expect static URLs to be invariant across wikis - this makes me wonder if we should be host-invariant on load.php as well?
2. We should probably exclude both static and /w/load.php from the session/token cookie cache-suppression stuff.

In T101892#1376688, @BBlack wrote:

1. In static-hash.inc.vcl.erb, we exclude the hostname from hashes on ^/(w/)?static [..] this makes me wonder if we should be host-invariant on load.php as well?

Must certainly not. Each wiki has its own module configuration. Different gadgets, extensions, skins, default skin, default language. Also users have different user preferences, and different pages that generate content composed as part of those modules. The message cache is also per-wiki (not to confuse with the localisation cache behind that which doesn't contain local-wiki message overrides).

Ignoring the user content and per-wiki message changes, the module scripts and styles from core would be the same. However even that isn't entirely true since even if the module content is the same, the startup module shouldn't be polluted with extensions from other wikis (the same way that extensions not installed on a wiki are not included at run time server-side and thus not available in the autoloader).

They also need to vary by wmf-branch / mediawiki version, but that could be worked around.

ok fair enough :)

Change 219108 had a related patch set uploaded (by BBlack):
Exclude /w/load.php and /static/ from session/token no-cache stuff

https://gerrit.wikimedia.org/r/219108

Change 219108 merged by BBlack:
Exclude /w/load.php and /static/ from session/token no-cache stuff

https://gerrit.wikimedia.org/r/219108