CacheControl

Cache-Control is an HTTP header field used to specify caching policies for both requests and responses. It governs how, and for how long, a resource may be cached, and by which caches (browsers, intermediary proxies, or content delivery networks). Introduced with HTTP/1.1, it complements or supersedes the older Expires header and is widely supported across HTTP versions.

The header consists of a set of directives—tokens either without a value or with a value in the form key=value, separated by commas. When present in a response, Cache-Control defines how caches should store and reuse that response. When present in a request, it communicates the client’s caching preferences to caches along the path to the origin server.

Common response directives include: public (the response may be cached by any cache), private (the response is intended for a single user and must not be stored by shared caches), no-store (do not cache), no-cache (revalidate with the origin before using a cached copy), max-age and s-maxage (specify freshness lifetimes for private and shared caches, with s-maxage taking precedence for shared caches), must-revalidate (revalidate after expiration), proxy-revalidate (same idea for shared caches), and no-transform (do not modify the resource).

Common request directives include no-cache, no-store, max-age, max-stale, and only-if-cached. These guide caches on whether to serve from cache or revalidate, and how stale a cached response may be.

Notes: Cache-Control directives override the Expires header when both are present, and caching behavior is influenced by validators like ETag or Last-Modified during revalidation.