Research shelf · dated reports
HTTP caching basics and focused follow-ups
Start with the baseline, then open the narrow report that matches the cache decision, deployment, or serving-layer question you are debugging.
Reports by question
| Report | Use it when you are asking… | Evidence or limitation |
|---|---|---|
| HTTP caching basics Dated baseline · 16 Sep 2026 | How do freshness, validation, private/shared storage, and common Cache-Control choices work? | Open the dated baseline report → |
| ETag versus Last-Modified Focused follow-up · 16 Sep 2026 | Which validator wins when both conditional request fields are sent? | If-None-Match wins; expected outcomes, not live-captured because curl was unavailable. Open the validator follow-up → |
| Cache-key & privacy mismatch Focused follow-up · 16 Sep 2026 | Could query values, Vary, cookies, Set-Cookie, or Authorization make one response eligible for the wrong request? | Adversarial worksheet plus clearly labeled local key/match model. Open the cache-key/privacy report → |
| Locating the serving layer New follow-up · 16 Sep 2026 | Is an old response from history/bfcache, a service worker, browser cache, intermediary, or origin? | Expected controlled path, layer matrix, decision tree, and limits; no live attribution claimed. Open the layer-attribution report → |
| CloudFront TTL policy and invalidation Audit refresh · 19 Sep 2026 | When can CloudFront's minimum/default/maximum TTL settings override origin intent, and should a deploy invalidate or version a URL? | Corrected precedence matrix, synthetic /account red flag, standalone s-maxage caveat, effective-key path scope, and versioning/invalidation choice; documentation-only, with no live CloudFront measurement or invalidation. Open the CloudFront report → |
| Cloudflare Cache Rules and Origin Cache Control New report · 20 Sep 2026 | How do OCC, Cache Rule Edge/Browser TTL, cache-key identity, and purge scope interact when an edge response looks stale or unexpectedly shared? | One-page precedence/purge matrix, private/public decision paths, CloudFront crosswalk, authorized-only verification template, and current source ledger; documentation-only with no zone capture or purge. Open the Cloudflare report → |
Choose by symptom
| If you are asking… | Start here | Evidence to capture |
|---|---|---|
| “Why did an old response appear?” | Serving-layer diagnosis, then the freshness baseline | Whether a request happened; worker/lifecycle state; Cache-Control, Age, Cache-Status, and the responding hop |
| “Which validator wins?” | ETag versus Last-Modified | If-None-Match and If-Modified-Since together, then status |
| “Could one person’s bytes reach another?” | Cache-key & privacy | Redacted A/B markers, cookies/auth variants, Vary, and same-hop hit/forward evidence |
| “Why did CloudFront keep an origin response fresh?” | CloudFront audit refresh | Effective MinTTL/DefaultTTL/MaxTTL, s-maxage, response-headers policy, and named-distribution status |
| “Should I purge or rename the asset?” | CloudFront invalidation vs versioning | Exact path, query/wildcard/rewrite scope, invalidation status, and downstream limits |
| “Does Cloudflare respect my origin header, and what did the purge clear?” | Cloudflare guide, then the dated report | OCC state, matching Cache Rule, custom key, CF-Cache-Status, Age, and authorized purge scope |