Research shelf · dated reports
HTTP caching basics and focused follow-ups
Start with the baseline, then open the narrow report that matches the cache decision, deployment, or serving-layer question you are debugging.
The dated baseline establishes freshness and storage, validator follow-up covers conditional precedence, cache-key follow-up covers variant matching and privacy, layer attribution covers serving provenance, the CloudFront audit tightens one provider's edge TTL and invalidation boundaries, the Cloudflare report covers OCC/Cache Rules, the RFC 9213 follow-up separates CDN-targeted fields from ordinary shared-cache policy, and the immutable follow-up separates response immutability from freshness lifetime and explicit reload behavior.
- HTTP caching basics — freshness · storage; dated baseline
- ETag vs date — conditional precedence; expected, not live-captured
- Cache-key privacy — Vary · Cookie · Auth; worksheet + local model
- Serving layer — browser · worker · edge; expected matrix
- CloudFront — TTL · purge scope; docs only
- Cloudflare — OCC · keys · purge; docs only
- CDN-targeted policy — RFC 9213 field selection · Cloudflare-specific precedence; docs only
- Immutable response — fresh vs stale · explicit check; standards and docs only
Reports by question
| Report | Use it when you are asking… | Evidence or limitation |
|---|---|---|
Cache-Control immutableNew dated follow-up · 28 Oct 2026 | What does immutable change while a response is fresh, what happens after it becomes stale, and how does a force reload differ from an ordinary reload? | RFC 8246 limits the revalidation recommendation to the response freshness lifetime; max-age supplies the example lifetime. The current MDN Chrome caveat is specific to reload subresources. Standards/documentation-only; no browser, cache, endpoint, or provider was tested. Open the concise guide · Open the dated report → |
| CDN-targeted Cache-Control New dated follow-up · 25 Oct 2026 | How does RFC 9213 select a CDN-specific response policy, how is it different from s-maxage, and what does Cloudflare document for targeted-field precedence? | Explains ordered target-list selection, ordinary fallback, end-to-end Age, a synthetic policy matrix, Cloudflare-specific precedence/forwarding, and privacy/key limits. Documentation-only; no implementation, zone, endpoint, or deployment was tested. Open the reader guide · Open the dated report → |
| Selecting stored responses after a 304 New dated follow-up · 22 Oct 2026 | Which stored responses can a 304 freshen, and how do strong, weak, and absent validators differ? | RFC 9111 §4.3.4 candidate selection and first-match validator branches; 304 updates metadata, not replacement content. The four-entry example is synthetic, and no implementation behavior was tested. Open the practical guide · Open the dated report → |
| Authorization responses and proxy-revalidate New dated follow-up · 19 Oct 2026 | Does proxy-revalidate permit a shared cache to reuse a response to a request carrying Authorization? | RFC 9111 §3.5 lists must-revalidate, public, and s-maxage; §5.2.2.8 instead gives proxy-revalidate a stale-validation role. Erratum 9004 proposed a no-behavior-change clarification, but final disposition was not confirmed from the accessible archive record. No implementation behavior was tested. Open the dated report → |
| How Age relates to current_age New dated follow-up · 16 Oct 2026 | How does RFC 9111 calculate current_age from a received Age, and what does the field identify? | Separates the §4.2.3 initial-age choices from resident time, then works a fully synthetic example. Age alone does not name a cache or hop; no live cache, endpoint, browser, provider, or header behavior was tested. Open the reader guide · Open the dated report → |
| Negative caching of missing versioned assets New dated follow-up · 13 Oct 2026 | Can a cached 404/410 for a missing asset persist after its bytes return, and what does the status tell me about storage or lifetime? | 404 and 410 are heuristically cacheable, not required to be cached; the status supplies no universal lifetime. A new no-store response does not purge an older negative response. Standards/documentation-only; no implementation result is claimed. Open the reader summary · Open the dated report → |
| POST response caching and unsafe-request invalidation New dated follow-up · 10 Oct 2026 | When may a stored POST response satisfy a later GET or HEAD, and what must a cache invalidate after an unsafe POST? | Requires explicit response freshness plus same-target Content-Location for POST-specific eligibility; later GET/HEAD only, not POST. Separately, write-through and 2xx/3xx target-URI invalidation apply in traversed caches only. The matrix is expected, not tested. Open the reader summary · Open the dated report → |
| Request-side HTTP cache controls New dated follow-up · 7 Oct 2026 | What does a request Cache-Control directive ask a cache to do, and how is that different from response policy? | Compares six request directives with response behavior; request directives are advisory, not universal bypass/origin-contact/purge commands. Synthetic examples are expected only; no authorized runtime or browser/provider experiment was available. Open the reader summary · Open the dated report → |
| Browser HTTP-cache partitioning: context is not policy New dated follow-up · 4 Oct 2026 | Why can the same resource URL be a different browser-cache candidate under another top-level site, and does that change a CDN's policy? | Separates the Fetch partition model, RFC 9111 cache rules, and Chromium/Firefox/WebKit documentation; the A/B examples are expected, not tested. No browser, endpoint, intermediary, or cache was measured. Open the reader summary · Open the dated report → |
| HTTP redirect caching and stale route targets New dated follow-up · 1 Oct 2026 | Why can a moved URL still send a request to an old destination, and how do I identify the redirect hop that supplied it? | Per-hop Location, status/method/cacheability comparison, freshness choices, and symptom checklist; all scenarios are expected and unexecuted. No live route, browser, provider, or cache test is claimed. Open the reader summary · Open the dated report → |
| Service-worker updates and stale client assets New dated follow-up · 28 Sep 2026 | Why can an open page keep using old code or asset URLs after a worker update, and when can an old Cache Storage entry be removed? | Specified update/install/wait/activate transitions, separate skipWaiting() and clients.claim() effects, conservative rollout, expected unexecuted checks, and explicit unknowns; documentation-only, with no browser/app result. Open the reader guide · Open the dated report → |
| When stale HTTP content is allowed New dated follow-up · 25 Sep 2026 | Can stale-while-revalidate or stale-if-error serve old bytes, how do max-age/s-maxage and revalidation constraints interact, and what can named-hop evidence prove? | Four gates, expected timing table, directive matrix, symptom paths, evidence limits, guardrails, and authorized-only test matrix; documentation-only with no live result. Open the reader summary · Open the dated report → |
| Cache deployment and incident runbook New dated report · 23 Sep 2026 | How do I choose a safe private/public deployment path, identify the serving hop, and decide between a versioned URL and a named-provider purge? | Provider-neutral checklist, evidence sequence, vendor-separated sidebars, and explicit browser/service-worker/corporate-proxy limits; documentation-only with no live provider capture. Open the runbook guide · Open the dated report → |
| HTTP caching basics Dated baseline · 16 Sep 2026 | How do freshness, validation, private/shared storage, and common Cache-Control choices work? | Open the dated baseline report → |
| ETag versus Last-Modified Focused follow-up · 16 Sep 2026 | Which validator wins when both conditional request fields are sent? | If-None-Match wins; expected outcomes, not live-captured because curl was unavailable. Open the validator follow-up → |
| Cache-key & privacy mismatch Focused follow-up · 16 Sep 2026 | Could query values, Vary, cookies, Set-Cookie, or Authorization make one response eligible for the wrong request? | Adversarial worksheet plus clearly labeled local key/match model. Open the cache-key/privacy report → |
| Locating the serving layer New follow-up · 16 Sep 2026 | Is an old response from history/bfcache, a service worker, browser cache, intermediary, or origin? | Expected controlled path, layer matrix, decision tree, and limits; no live attribution claimed. Open the layer-attribution report → |
| CloudFront TTL policy and invalidation Audit refresh · 19 Sep 2026 | When can CloudFront's minimum/default/maximum TTL settings override origin intent, and should a deploy invalidate or version a URL? | Corrected precedence matrix, synthetic /account red flag, standalone s-maxage caveat, effective-key path scope, and versioning/invalidation choice; documentation-only, with no live CloudFront measurement or invalidation. Open the CloudFront report → |
| Cloudflare Cache Rules and Origin Cache Control New report · 20 Sep 2026 | How do OCC, Cache Rule Edge/Browser TTL, cache-key identity, and purge scope interact when an edge response looks stale or unexpectedly shared? | One-page precedence/purge matrix, private/public decision paths, CloudFront crosswalk, authorized-only verification template, and current source ledger; documentation-only with no zone capture or purge. Open the Cloudflare report → |
Choose by symptom
| If you are asking… | Start here | Evidence to capture |
|---|---|---|
“Does a received Age tell me the current age now?” | Age and current_age guide, then the dated report | Date, received Age, request/response time, resident time, clock context, and a named responding hop; Age alone is not hop attribution |
| “Why does a restored versioned asset still return 404?” | Missing-asset guide, then the dated report | Exact asset URI and method, status/body, response freshness, request conditionals, a trusted named Cache-Status member, and correlated origin evidence; Age alone is not a hop label |
| “When may a POST response be reused, and where does an unsafe POST invalidate stored responses?” | POST response caching guide, then the dated report | Response freshness, exact target and Content-Location, later method, unsafe request response status, and which caches the request traversed |
“What does a request Cache-Control field ask the next cache to do?” | Request cache-controls summary, then the dated report | Separate request preference from response policy; capture named-hop evidence if testing an authorized fixture |
| “Why does the same resource behave differently under two sites?” | Browser cache partitioning, then the dated report | Browser/version, top-level site, frame context, request variants, ordinary freshness/validation, and separately named intermediary evidence |
| “Why does a moved URL still land on the old destination?” | Redirect caching summary, then the dated report | Every request URI/method, response status and Location, validators, freshness fields, and named-hop evidence |
| “Why does an open page still use old code or asset URLs after a deploy?” | Service-worker update guide, then the dated report | Page and worker build markers; registration states; controller URL; exact asset request; worker cache name and hit/miss; downstream evidence |
| “Why did an old response appear?” | Serving-layer diagnosis, then the freshness baseline | Whether a request happened; worker/lifecycle state; Cache-Control, Age, Cache-Status, and the responding hop |
| “Which validator wins?” | ETag versus Last-Modified | If-None-Match and If-Modified-Since together, then status |
| “Could one person’s bytes reach another?” | Cache-key & privacy | Redacted A/B markers, cookies/auth variants, Vary, and same-hop hit/forward evidence |
| “Why did CloudFront keep an origin response fresh?” | CloudFront audit refresh | Effective MinTTL/DefaultTTL/MaxTTL, s-maxage, response-headers policy, and named-distribution status |
| “Should I purge or rename the asset?” | CloudFront invalidation vs versioning | Exact path, query/wildcard/rewrite scope, invalidation status, and downstream limits |
| “How should I deploy safely or triage an old response?” | Deployment and incident runbook | Representation sensitivity, storage audience, named-hop evidence, origin marker/counter, and downstream limits |
| “Can a cache serve old content while it revalidates or the origin errors?” | When stale content is allowed, then the dated follow-up | Applicable max-age/s-maxage, stale directive, prohibition, Cache-Status, validators, and named error/304 result |
| “Does Cloudflare respect my origin header, and what did the purge clear?” | Cloudflare guide, then the dated report | OCC state, matching Cache Rule, custom key, CF-Cache-Status, Age, and authorized purge scope |
| “Can a CDN have its own response freshness policy, and how does Cloudflare prioritize the fields?” | CDN-targeted Cache-Control, then the dated report | Identify the cache’s target list, selected field, ordinary fallback, Cloudflare overrides, response age, and downstream cache policy; use a named-zone capture for a live result |