HTTP Cache-Control Builder

Cache-Control is an HTTP header that controls how browsers, CDNs, and proxies cache responses. Key directives: max-age=N (cache for N seconds), s-maxage=N (CDN-only override for max-age), no-cache (cache but revalidate every request), no-store (never cache), private (browser only, no CDN), public (shareable caches allowed), immutable (file won't change — skip revalidation), must-revalidate (don't use stale content), stale-while-revalidate=N (serve stale for N seconds while fetching fresh in background).

no-cache means 'cache the response, but always revalidate before using it.' The browser stores the response and sends a conditional request (If-None-Match or If-Modified-Since). If the server returns 304 Not Modified, the cached version is used at zero data transfer cost. no-store means 'never save this response anywhere.' Every request fetches a completely fresh copy. Use no-store for sensitive data (bank statements, private health records). Use no-cache for HTML pages that need to stay fresh but can benefit from 304 conditional requests.

Use immutable for assets with content-hashed URLs like bundle.a3f9c1.js or styles.8e7d2b.css. These files never change at a given URL — the filename changes when content changes. immutable tells browsers to never revalidate even on reload (Ctrl+F5). Combined with max-age=31536000 (1 year), this eliminates all network requests for cached assets on repeat visits, dramatically improving performance.

stale-while-revalidate=N allows serving a stale (expired) cached response for N seconds while fetching a fresh copy in the background. This eliminates the latency spike that occurs when a cache entry expires — users always get an instant response, and the cache is updated asynchronously. Pattern: Cache-Control: max-age=60, stale-while-revalidate=300 — serve fresh for 60 seconds, serve stale for 5 more minutes while refreshing. Widely supported in modern browsers and CDNs like Cloudflare.

public means the response can be stored by any cache — browser, CDN, or intermediary proxy. Use this for static assets that are the same for all users. private means only the user's own browser can cache it — CDNs must not store it. Use private for authenticated responses that contain user-specific data. If you omit both, the cache behavior is heuristic-based and inconsistent across implementations — always set one explicitly.

An ETag is a fingerprint of the response content (usually a hash or timestamp). When a cached response expires, the browser sends the ETag in an If-None-Match request header. If the content hasn't changed, the server responds with 304 Not Modified and no body — saving bandwidth. ETags work alongside Cache-Control: no-cache for HTML pages: the page is always revalidated, but if nothing changed, the revalidation costs only a round trip with no data transfer.