Overview & Scope
HTTP caching is governed by RFC 9111. It allows intermediate proxies, CDNs, and browsers to store copies of responses to satisfy subsequent requests without contacting the origin server, drastically accelerating web performance.
Specification Table & Matrix
Instant client-side filter by keyword, status code, or directive name
| Key / Code | Definition & Details | GEO Semantic Hierarchy | Spec & Notes |
|---|---|---|---|
| no-store | no-store Directs caches not to store any part of the request or response in any non-volatile or shared storage. Cache-Control: no-store | ●no-store ↳Cache-Control directive ↳storage rule ↳absolute cache prevention | RFC 9111 §5.2.2.5 Mandatory for bank transactions, medical data, and authenticated secrets. |
| no-cache | no-cache Indicates the response may be cached, but MUST be revalidated with origin server before every reuse. Cache-Control: no-cache | ●no-cache ↳Cache-Control directive ↳validation rule ↳mandatory conditional revalidation | RFC 9111 §5.2.2.4 Often misunderstood: it DOES allow caching, but forces a conditional (If-None-Match) check first. |
| public | public Indicates that any cache (browser, intermediate CDN, ISP proxy) may store the response. Cache-Control: public, max-age=86400 | ●public ↳Cache-Control directive ↳visibility rule ↳shared CDN edge storage | RFC 9111 §5.2.2.9 Permits CDNs to cache responses even if the original request carried an Authorization header. |
| private | private Indicates the response is intended for a single user and MUST NOT be stored by shared caches (CDNs). Cache-Control: private, max-age=3600 | ●private ↳Cache-Control directive ↳visibility rule ↳browser-only storage | RFC 9111 §5.2.2.7 Allows the user browser to cache personalized dashboards while preventing CDN data leaks. |
| max-age | max-age=<seconds> Specifies the maximum amount of time in seconds that a response is considered fresh. max-age=31536000 | ●max-age ↳Cache-Control directive ↳freshness TTL ↳lifetime countdown | RFC 9111 §5.2.2.1 Calculated relative to response generation time; overrides the Expires header. |
| s-maxage | s-maxage=<seconds> Overrides max-age specifically for shared caches (CDNs, Cloudflare, Fastly). s-maxage=604800, max-age=3600 | ●s-maxage ↳Cache-Control directive ↳CDN specific TTL ↳edge freshness override | RFC 9111 §5.2.2.10 Allows CDNs to hold a resource for 7 days while browser caches expire after 1 hour. |
| stale-while-revalidate | stale-while-revalidate=<seconds> Instructs cache to serve stale content instantly while asynchronously revalidating in the background. max-age=60, stale-while-revalidate=86400 | ●stale-while-revalidate ↳Cache-Control directive ↳background revalidation ↳zero-latency revalidation | RFC 5861 §3 Delivers instantaneous page loads while ensuring users receive fresh data on subsequent visits. |
| immutable | immutable Indicates that the response body will never change over time during its fresh lifetime. public, max-age=31536000, immutable | ●immutable ↳Cache-Control directive ↳immutability flag ↳reload conditional check suppression | RFC 8246 Prevents browsers from sending 304 conditional checks even when the user clicks Refresh (F5). |
Modern SPA Caching Strategy (HTML vs Fingerprinted Assets)
# 1. index.html: NEVER CACHE (Always fetch fresh version to get latest JS bundle hashes)
location = /index.html {
add_header Cache-Control "no-cache, no-store, must-revalidate";
}
# 2. Fingerprinted Assets (main.a8f9c1.js, style.b2e3.css): CACHE FOREVER (1 year)
location ~* \.[a-f0-9]{8,}\.(?:js|css|png|jpg|svg|woff2)$ {
add_header Cache-Control "public, max-age=31536000, immutable";
}Since bundle filenames include content hashes, caching them for 1 year is 100% safe. New releases change the hash, forcing immediate updates.
Reference Standards Q&A
What is the difference between no-cache and no-store?↓
References & Primary Sources
Every source below directly substantiates technical statements and protocol behaviors explained in HTTP Caching Reference. Curious-Techie prioritizes official Internet standards (IETF RFCs, W3C Recommendations, WHATWG specifications) and established security bodies (OWASP, NIST). Zero sponsored or secondary links.
- [1]IETFPrimary SpecificationRFC 9110 • Core ArchitectureVerified Primary SourceTechnical Claim Supported:
Foundational specification for the stateless client-server request-response architecture, standard status codes (1xx–5xx), and method safety and idempotency.
Source URI: https://datatracker.ietf.org/doc/html/rfc9110 - [2]IETFPrimary SpecificationRFC 9112 • Section 3 & 6Verified Primary SourceTechnical Claim Supported:
Defines ASCII wire protocol framing, chunked transfer encoding, and persistent connection Keep-Alive mechanics.
Source URI: https://datatracker.ietf.org/doc/html/rfc9112 - [3]IETFPrimary SpecificationRFC 9113 • Section 4 & 5Verified Primary SourceTechnical Claim Supported:
Standardizes binary framing, HPACK header compression, and bi-directional stream multiplexing over a single shared TCP connection.
Source URI: https://datatracker.ietf.org/doc/html/rfc9113 - [4]IETFPrimary SpecificationRFC 9114 • Section 3 & 4Verified Primary SourceTechnical Claim Supported:
Eliminates TCP head-of-line blocking by mapping HTTP streams directly over QUIC UDP transport connections with integrated TLS 1.3 encryption.
Source URI: https://datatracker.ietf.org/doc/html/rfc9114
Related Technical Ecosystem & Next Steps
Related Developer Tools
Related Technical Guides
Related Technical Articles
What Is HTTP (Hypertext Transfer Protocol)?
Foundational stateless request-response protocol of the World Wide Web.
HTTP/1.1 vs HTTP/2: Multiplexing & Performance
Head-of-line blocking compared to binary framing and stream multiplexing.
Troubleshooting: HTTP 403 Forbidden Error
Diagnose server authorization denial, WAF IP blocks, and permission issues.
Related Questions
Why Is POST Non-Idempotent While PUT Is Idempotent?
Answer: PUT replaces or creates a specific resource deterministically, while POST processes input according to server logic, typically creating new items on repeated requests.
What Is the Difference Between ETag and Last-Modified?
Answer: Last-Modified relies on 1-second filesystem timestamps, while ETag provides an exact cryptographic digest of content, eliminating false positive cache misses.
Can HTTP/2 Multiplex Requests Over a Single TCP Connection?
Answer: Yes, HTTP/2 breaks requests into binary frames with stream IDs, allowing interleaved requests and responses concurrently over one TCP socket.
Hands-On Diagnostic Labs
Continue Learning
HTTP Protocol & Header Inspection Lab
Craft raw HTTP headers and observe conditional 304 responses in the interactive workbench.