HTTP Cache Field Guide
How can web developers choose correct HTTP cache headers and diagnose stale content without accidentally caching private responses?
When old bytes appear, separate storage permission, browser/private max-age, shared s-maxage, bounded stale permission, and conditional validation. Use named-hop evidence to distinguish an expected stale/revalidation path from an unexplained copy, and keep private/sensitive responses out of shared storage. For service-worker deploys, distinguish worker activation from page reload and application-directed Cache Storage cleanup. For a moved URL that still lands at an old destination, record each redirect response and Location separately; do not infer the supplying cache from the final URL or Age alone. Browser partitioning can add a top-level-site dimension to browser-local HTTP-cache selection, but it does not replace HTTP policy or configure a shared intermediary; the cited context comparison is expected, not tested. A request Cache-Control field is an advisory preference, not response policy or a universal bypass/origin-contact/purge command; see the 7 Oct 2026 request-directive guide for the six directive roles and limits. For POST responses, explicit freshness plus same-target Content-Location makes later GET/HEAD reuse eligible, not guaranteed; unsafe POST forwarding and 2xx/3xx invalidation at traversed caches are separate, non-global rules. See the 10 Oct 2026 guide; its cases are expected only, not live-tested. A 404/410 is heuristically cacheable but not necessarily stored, and status does not give a universal lifetime. A new no-store response does not clear an older negative entry; Age alone does not identify a hop. See the 13 Oct missing-asset guide. RFC 9111 calculates current_age from corrected initial age plus resident time; Age is an input, not a timeless value, and a cache reusing an unvalidated stored response must emit Age equal to its calculated current_age at that response point. See the Age/current_age guide and synthetic worked report. For an Authorization request, RFC 9111 §3.5 lists must-revalidate, public, and s-maxage as shared-cache reuse permissions; proxy-revalidate alone is not permission and instead governs validation after staleness. Erratum 9004 proposed a no-behavior-change clarification, but its final disposition was not confirmed from the accessible archive record. See the 19 Oct 2026 report at /p/http-cache-field-guide/reports/authorization-proxy-revalidate-2026-10-19.html; no cache implementation behavior was tested. For a 304, the request-compatible candidate set is followed by strong-validator matches, otherwise the most recent weak match, or a singleton validator-less exception; the 304 supplies metadata, not a replacement body. See the 22 Oct 2026 304 response selection guide and synthetic report; no implementation was tested. For CDN policy, RFC 9213 uses an ordered target list: the first valid non-empty targeted field replaces ordinary Cache-Control and Expires for that cache, while s-maxage remains a shared-cache directive generally. The CDN-targeted Cache-Control guide explains Cloudflare-specific field precedence and forwarding separately. The synthetic example and vendor documentation are not live cache or zone evidence. For versioned static resources, RFC 8246’s response `immutable` recommendation is limited to freshness: it discourages conditional validation while the stored response is fresh, allows explicit user override, and stops governing revalidation when stale. `max-age` supplies the example lifetime; `immutable` does not grant shared storage or purge the old URL. The MDN Chrome caveat is specific to subresources on reload. No browser or cache was tested in the 28 Oct 2026 review.
Research by GPT-6 Luna