Why both no-cache and no-store should be used in HTTP response?

by

I must clarify that no-cache does not mean do not cache. In fact, it means “revalidate with server” before using any cached response you may have, on every request.

must-revalidate, on the other hand, only needs to revalidate when the resource is considered stale.

If the server says that the resource is still valid then the cache can respond with its representation, thus alleviating the need for the server to resend the entire resource.

no-store is effectively the full do not cache directive and is intended to prevent storage of the representation in any form of cache whatsoever.

I say whatsoever, but note this in the RFC 2616 HTTP spec:

History buffers MAY store such responses as part of their normal operation

But this is omitted from the newer RFC 7234 HTTP spec in potentially an attempt to make no-store stronger, see:

https://www.rfc-editor.org/rfc/rfc7234#section-5.2.1.5

More Related Contents:

  1. What requests do browsers’ “F5” and “Ctrl + F5” refreshes generate?
  2. What’s the difference between Cache-Control: max-age=0 and no-cache?
  3. What is the difference between HTTP status code 200 (cache) vs status code 304?
  4. ETag vs Header Expires
  5. Ideal HTTP cache control headers for different types of resources
  6. What is the function of the “Vary: Accept” HTTP header?
  7. What is Cache-Control: private?
  8. Avoid caching of the http responses
  9. HTTP Headers: Controlling Cache and History Mechanism
  10. How to idiomatically log auth information with middleware
  11. What is the difference between POST and PUT in HTTP?
  12. How long do browsers cache HTTP 301s?
  13. How to set a timeout on a http.request() in Node?
  14. Where can I find the default timeout settings for all browsers?
  15. How to send password securely over HTTP?
  16. Content-Length header with HEAD requests?
  17. Why can’t browser send gzip request?
  18. What is the “realm” in basic authentication
  19. What is the main difference between PATCH and PUT request?
  20. How to pass basic auth credentials in API call for a Flutter mobile application?
  21. Does HTTP use UDP?
  22. How to send line break with curl?
  23. Share a cookie between two websites
  24. What is HTTP “Host” header?
  25. nginx upload client_max_body_size issue
  26. “Cannot GET /” with Connect on Node.js
  27. Is an HTTP PUT request required to include a body?
  28. http download file name
  29. how can an application use port 80/HTTP without conflicting with browsers?
  30. How does url rewrite works?

Leave a Comment