Übersicht & Anwendungsbereich
Die RFC 9111-Spezifikation standardisiert das Zusammenspiel zwischen Browser-Caches, Proxies und CDNs zur Maximierung der Webleistung.
Spezifikationstabelle & Matrix
Echtzeit-Filter nach Stichwort, Statuscode oder Direktive
| Schlüssel / Code | Definition & Details | Semantische GEO-Hierarchie | Spezifikation & Hinweise |
|---|---|---|---|
| no-store | no-store Directs caches not to store any part of the request or response in any non-volatile or shared storage. Cache-Control: no-store | ●no-store ↳Cache-Control directive ↳storage rule ↳absolute cache prevention | RFC 9111 §5.2.2.5 Mandatory for bank transactions, medical data, and authenticated secrets. |
| no-cache | no-cache Indicates the response may be cached, but MUST be revalidated with origin server before every reuse. Cache-Control: no-cache | ●no-cache ↳Cache-Control directive ↳validation rule ↳mandatory conditional revalidation | RFC 9111 §5.2.2.4 Often misunderstood: it DOES allow caching, but forces a conditional (If-None-Match) check first. |
| public | public Indicates that any cache (browser, intermediate CDN, ISP proxy) may store the response. Cache-Control: public, max-age=86400 | ●public ↳Cache-Control directive ↳visibility rule ↳shared CDN edge storage | RFC 9111 §5.2.2.9 Permits CDNs to cache responses even if the original request carried an Authorization header. |
| private | private Indicates the response is intended for a single user and MUST NOT be stored by shared caches (CDNs). Cache-Control: private, max-age=3600 | ●private ↳Cache-Control directive ↳visibility rule ↳browser-only storage | RFC 9111 §5.2.2.7 Allows the user browser to cache personalized dashboards while preventing CDN data leaks. |
| max-age | max-age=<seconds> Specifies the maximum amount of time in seconds that a response is considered fresh. max-age=31536000 | ●max-age ↳Cache-Control directive ↳freshness TTL ↳lifetime countdown | RFC 9111 §5.2.2.1 Calculated relative to response generation time; overrides the Expires header. |
| s-maxage | s-maxage=<seconds> Overrides max-age specifically for shared caches (CDNs, Cloudflare, Fastly). s-maxage=604800, max-age=3600 | ●s-maxage ↳Cache-Control directive ↳CDN specific TTL ↳edge freshness override | RFC 9111 §5.2.2.10 Allows CDNs to hold a resource for 7 days while browser caches expire after 1 hour. |
| stale-while-revalidate | stale-while-revalidate=<seconds> Instructs cache to serve stale content instantly while asynchronously revalidating in the background. max-age=60, stale-while-revalidate=86400 | ●stale-while-revalidate ↳Cache-Control directive ↳background revalidation ↳zero-latency revalidation | RFC 5861 §3 Delivers instantaneous page loads while ensuring users receive fresh data on subsequent visits. |
| immutable | immutable Indicates that the response body will never change over time during its fresh lifetime. public, max-age=31536000, immutable | ●immutable ↳Cache-Control directive ↳immutability flag ↳reload conditional check suppression | RFC 8246 Prevents browsers from sending 304 conditional checks even when the user clicks Refresh (F5). |
Modern SPA Caching Strategy (HTML vs Fingerprinted Assets)
# 1. index.html: NEVER CACHE (Always fetch fresh version to get latest JS bundle hashes)
location = /index.html {
add_header Cache-Control "no-cache, no-store, must-revalidate";
}
# 2. Fingerprinted Assets (main.a8f9c1.js, style.b2e3.css): CACHE FOREVER (1 year)
location ~* \.[a-f0-9]{8,}\.(?:js|css|png|jpg|svg|woff2)$ {
add_header Cache-Control "public, max-age=31536000, immutable";
}Since bundle filenames include content hashes, caching them for 1 year is 100% safe. New releases change the hash, forcing immediate updates.
Standard-Spezifikation Q&A
What is the difference between no-cache and no-store?↓
References & Primary Sources
Every source below directly substantiates technical statements and protocol behaviors explained in HTTP-Caching & Cache-Control Referenz (RFC 9111). Curious-Techie prioritizes official Internet standards (IETF RFCs, W3C Recommendations, WHATWG specifications) and established security bodies (OWASP, NIST). Zero sponsored or secondary links.
- [1]IETFPrimary SpecificationRFC 9110 • Core ArchitectureVerified Primary SourceTechnical Claim Supported:
Foundational specification for the stateless client-server request-response architecture, standard status codes (1xx–5xx), and method safety and idempotency.
Source URI: https://datatracker.ietf.org/doc/html/rfc9110 - [2]IETFPrimary SpecificationRFC 9112 • Section 3 & 6Verified Primary SourceTechnical Claim Supported:
Defines ASCII wire protocol framing, chunked transfer encoding, and persistent connection Keep-Alive mechanics.
Source URI: https://datatracker.ietf.org/doc/html/rfc9112 - [3]IETFPrimary SpecificationRFC 9113 • Section 4 & 5Verified Primary SourceTechnical Claim Supported:
Standardizes binary framing, HPACK header compression, and bi-directional stream multiplexing over a single shared TCP connection.
Source URI: https://datatracker.ietf.org/doc/html/rfc9113 - [4]IETFPrimary SpecificationRFC 9114 • Section 3 & 4Verified Primary SourceTechnical Claim Supported:
Eliminates TCP head-of-line blocking by mapping HTTP streams directly over QUIC UDP transport connections with integrated TLS 1.3 encryption.
Source URI: https://datatracker.ietf.org/doc/html/rfc9114
Zugehöriges technisches Ökosystem & nächste Schritte
Verwandte Entwickler-Werkzeuge
Verwandte Leitfäden
Verwandte Fachartikel
What Is HTTP (Hypertext Transfer Protocol)?
Foundational stateless request-response protocol of the World Wide Web.
HTTP/1.1 vs HTTP/2: Multiplexing & Performance
Head-of-line blocking compared to binary framing and stream multiplexing.
Troubleshooting: HTTP 403 Forbidden Error
Diagnose server authorization denial, WAF IP blocks, and permission issues.
Verwandte technische Fragen
Why Is POST Non-Idempotent While PUT Is Idempotent?
Answer: PUT replaces or creates a specific resource deterministically, while POST processes input according to server logic, typically creating new items on repeated requests.
What Is the Difference Between ETag and Last-Modified?
Answer: Last-Modified relies on 1-second filesystem timestamps, while ETag provides an exact cryptographic digest of content, eliminating false positive cache misses.
Can HTTP/2 Multiplex Requests Over a Single TCP Connection?
Answer: Yes, HTTP/2 breaks requests into binary frames with stream IDs, allowing interleaved requests and responses concurrently over one TCP socket.
Praxis-Diagnoselabore
Weiterlernen
HTTP Protocol & Header Inspection Lab
Craft raw HTTP headers and observe conditional 304 responses in the interactive workbench.