Cache-Control

What the Cache-Control header does

Cache-Control is the primary header for caching, carrying directives for browsers and proxies: max-age=3600 (cache for an hour), public/private, no-cache (revalidate before use), and no-store (don't cache at all). It overrides the older Expires header.

Example

Cache-Control: max-age=3600, public

Cache-Control in practice

Versioned static asset

Cache-Control: public, max-age=31536000, immutable

HTML that must revalidate

Cache-Control: no-cache

Sensitive responses

Cache-Control: no-store

Common Cache-Control questions and problems

no-cache vs no-store?

no-store means do not store the response at all. no-cache lets caches store it but requires revalidation with the origin before each reuse.

max-age vs s-maxage?

max-age applies to every cache, including the browser. s-maxage applies only to shared caches such as CDNs and overrides max-age there.

How do I cache static assets for a long time safely?

Fingerprint the file names (app.3f2a1c.js) and send Cache-Control: public, max-age=31536000, immutable. Changed files get new URLs, so stale copies are never an issue.

How do I keep HTML fresh but fast?

Use a short max-age or no-cache with an ETag, so browsers revalidate and receive a 304 when nothing changed.

Cache-Control vs related headers

• Expires: Expires is the older absolute-date mechanism. When both are present, Cache-Control: max-age wins.
• ETag: ETag is the validator used when a cached copy must be revalidated; Cache-Control decides when.
• Age: Age reports how long a response has already spent in a cache.

Where it's used

Cache-Control is a caching header. Caching headers control how browsers and proxies store and reuse responses.

Other caching headers