Caching and Conditional Requests

A stored response is fresh while its age is below its freshness lifetime; it can be reused with no network trip. Once age exceeds that lifetime it is stale — which does not mean deleted. The cache normally revalidates with the origin, and a successful check makes the copy usable again with a reset clock.

That is the lost update problem: the second PUT was computed from stale data and overwrote the first. HTTP prevents it with a conditional write - the client echoes the ETag it read in an If-Match header, and the server answers 412 Precondition Failed on mismatch.

A private cache serves one user - the browser's own store. A shared cache serves many - a CDN, proxy or gateway. Cache-Control: private forbids shared caches from storing the response; public explicitly permits storing even responses that would otherwise be ineligible, such as authenticated ones.

The server sends an ETag identifying the representation. On the next request the client sends If-None-Match with that value; if it still matches, the server replies 304 Not Modified with headers but no body, and the client reuses its stored copy. Only the round trip is spent, not the payload.

Vary is a response header listing the request headers the server used to choose this response. The cache keys the entry on the URL plus those header values, so it reuses the stored copy only when a new request has matching values.

private restricts storage to a single-user cache (the browser); shared caches such as CDNs and proxies must not store it. public allows shared storage even when rules would normally forbid it. s-maxage sets a freshness lifetime that only shared caches use, overriding max-age. Omitting private on per-user content lets a CDN serve one user's data to everyone.

s-maxage sets the freshness lifetime for shared caches only and overrides max-age there; browsers ignore it. CDN-Cache-Control and Surrogate-Control go further: they target the CDN specifically and are consumed by it, so browser, CDN and origin tiers can be tuned independently.

A strong ETag promises byte-for-byte identity of the representation; W/ marks a weak one promising only semantic equivalence. Conditional GET uses weak comparison, so both produce 304. Range requests and write preconditions like If-Match use strong comparison, where a weak tag never matches.

Compression makes one URL produce two different bodies. Without Vary: Accept-Encoding a cache stores one of them and serves it to everyone, so a client that cannot decompress may receive gzip bytes, or a gzip-capable client gets an uncompressed body.

Only about 60 more seconds. The Age header says the response is already 240 seconds old, and max-age=300 counts from origin generation, not from arrival. Current age = the age it arrived with (from Age or Date) plus the time it has since sat in your cache.

Cache-Control: max-age wins for any cache that understands HTTP/1.1 — essentially all of them. Expires is the HTTP/1.0 absolute-timestamp form and survives only as a fallback. Expires: 0 is an invalid date, which caches must treat as already expired, so it is a compact "already stale" marker for ancient caches.

If-Match compares an opaque ETag, so any change is detected exactly. If-Unmodified-Since compares an HTTP date with one-second resolution, so two edits inside the same second look unchanged and a stale write slips through. Prefer If-Match; use the date only when no ETag exists.

The long max-age already stops normal re-fetching. immutable (RFC 8246) additionally tells the browser not to send a conditional revalidation request when the user reloads the page — the case where browsers otherwise revalidate anyway. On a non-fingerprinted URL it is unsafe: clients can pin the old bytes for a year with no way to purge them.

stale-while-revalidate=60 lets a cache serve an expired response immediately for up to 60 more seconds while it refreshes in the background, so no user waits on the origin. stale-if-error=86400 lets it serve an expired response for up to a day when revalidation fails or the origin returns 5xx. Both trade bounded staleness for latency and availability.

With no explicit lifetime, a cache may invent one heuristically — commonly ten percent of the time since Last-Modified. A page unchanged for a hundred days can therefore be cached for ten. The fix is to always send an explicit Cache-Control, such as no-cache for content that must be current.

428 means the request was refused because it carried no precondition. A server returns it on unconditional PUT/PATCH/DELETE when it wants to force clients to send If-Match, so nobody can blindly overwrite state. The response should explain which precondition is expected.

Read the Age header and the CDN's cache-status header: a large Age means the edge is serving a stored copy, and Age accumulates across tiers. Purge actively evicts the edge copy now; revalidation only makes the edge ask the origin once its entry goes stale. Browser copies must expire on their own.

HTTP dates resolve to one second, so a change in the same second a client fetched is invisible and the client keeps stale content indefinitely. Timestamps also move on deploys or restores without content changing. Emit an ETag derived from content or a version, keeping Last-Modified alongside it.

Vary: Cookie makes the cache key include the whole cookie header, which is near-unique per user, so shared caching effectively stops. Vary: * forbids reuse outright. Both are blunt; for genuinely per-user data use Cache-Control: private or no-store instead.

The response is missing Vary: Origin. Since the body and headers depend on the request's Origin, the cache stores one copy with one site's origin baked in and replays it to requests from other origins, so those browsers see a mismatched Access-Control-Allow-Origin.

On a request they express the client's tolerance. no-cache demands revalidation before any stored response is reused; max-age=0 says accept nothing older than zero seconds, so effectively the same; max-stale=N accepts responses stale by up to N seconds; min-fresh=N demands at least N seconds of remaining freshness; only-if-cached says answer from cache or return 504, never go to the origin.

Keep only headers that actually change the bytes, and collapse each to the smallest set of values the origin can really produce. Anything high-cardinality gets normalized to a derived low-cardinality header, or the variation moves into the URL instead.