HTTP caching headers

Caching and Redis Mid-level Python 3.13+ PostgreSQL 17+ Reviewed By Best Latest Apps

Pick the fix

GET /me returns the signed-in user's profile. Which header is right?

Options
Hint 1 of 1

Who may store a personal response?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Cache-Control: private, max-age=0, must-revalidate with an ETag

Correct. Only the browser keeps it, and it revalidates each time.

private keeps shared caches like CDNs from storing one user's data. max-age=0 with must-revalidate makes the browser ask every time, and the ETag lets the server answer 304 when nothing changed.

Why not the others?
  • B Cache-Control: public, max-age=300. A CDN could serve one user's profile to another.
  • C Cache-Control: s-maxage=300. Lets shared caches store personal data.
  • D Cache-Control: immutable. Profiles change.

30-second answer

Cache-Control: max-age=60 lets any cache reuse the response for 60 seconds. s-maxage overrides it for shared caches like CDNs. private allows only the user's browser to cache it, which you need for personalised responses. no-cache means store it but revalidate every time (with ETag), while no-store means never store it. stale-while-revalidate=30 lets caches serve a stale copy while they refresh in the background.

Practise saying it · 30 s. No recording, just a timer

Explain Cache-Control.

Say your answer out loud, then check which of these points you covered:

  • max-age, s-maxage
  • private vs public
  • no-cache vs no-store
  • stale-while-revalidate
  • ETag + Vary

Deep dive

Pair caching with validators (ETag) so revalidation returns a cheap 304.

Vary tells caches which request headers change the response (Accept-Encoding, Accept-Language); avoid Vary: Cookie on shared caches.

Fingerprinted static assets can be max-age=31536000, immutable.

API responses with personal data: private or no-store.

Common mistakes

  • Using no-cache when you mean no-store.
  • Letting a CDN cache a response that contains one user's data.
  • Long max-age on HTML that references changing assets.

Senior take & follow-ups

Explain each directive briefly, then private vs shared caches and validators.

Follow-up questions

Think of your answer first, then open the hint.

  1. no-cache vs no-store?

    Show hint

    no-cache: store but revalidate; no-store: don't store.

  2. What does immutable add?

    Show hint

    Browsers skip revalidation even on reload.

Related questions

Suggest a fix if something here is wrong or out of date.