Caching

Old red bytes keep their old digest filename while changed blue bytes use a new digest filename.

Immutable assets and fingerprints

A fingerprinted asset puts a digest of its bytes into its URL. Changing a stylesheet produces a different address, so a page can request the new representation without depending on every existing cache expiring simultaneously. The useful guarantee comes from the publishing process: once an address is released, its contents must remain consistent with that digest. ...

Two receipt estimates, 12 seconds and 7 seconds, merge by maximum into 12; adding 8 seconds of residence yields current age 20 seconds.

The Age header tells how long a cached copy has been around

Age is an estimate of elapsed seconds since an origin generated or successfully validated a response. It includes time in caches and in transit. It is not the object’s creation timestamp, a count of requests, or simply the time spent on the last proxy’s disk. Reading it correctly requires the response’s freshness policy and the request context. ...

For the article’s fresh max-age=300 fixture, the private/shared table shows storage and direct-reuse pairs: private yes/yes and no/no; public yes/yes in both; no-cache yes/no in both; no-store no/no in both. A same-browser account switch can still match an old private entry.

Cache-Control private versus shared

Storage scope is not an identity system. Cache-Control: private tells a conforming shared cache not to store a response; it does not teach a browser which application account owns the bytes. This distinction matters when a person logs out, another account logs in, and the same browser requests the same URL again. ...

For a direct query without aliases, NXDOMAIN means the name is missing, while NODATA means the requested type is missing. Authoritative negative lifetime is the smaller of SOA TTL and MINIMUM.

Negative DNS answers preserve absence until their cache lifetime expires

DNS can return useful information by saying that data is absent. NXDOMAIN reports a name error; NODATA describes a successful response without the requested record type. In a direct query without aliases, these distinguish a nonexistent name from an existing name that lacks the requested data. Caching those results avoids repeating the same unsuccessful upstream lookup for every client request. ...

Two lanes connect matching Accept and Content-Type media types under Vary: Accept, for one URI.

Content-Type and Vary work together

One URL can return JSON to an API client and plain text to another reader. Content-Type identifies the selected representation; Vary identifies request fields relevant to selecting it. A correct body label cannot prevent a cache from choosing the wrong stored response when the request-matching information is missing. ...

Strong validators distinguish changed bytes; weak validators may preserve semantic equivalence. A fixed incorrect tag can return false 304 after the object changes.

ETags and conditional requests avoid work

A 304 is useful only when the old representation really remains an acceptable substitute. ETag supplies the origin’s version claim; it does not independently verify that claim. An incorrect tag can make conditional requests efficiently preserve wrong content. Test both unchanged data and meaningful changes before counting reduced transfers as a performance improvement. ...

For max-age=60, age 59 seconds is fresh and reuses the response. Ages 60 and 61 seconds are stale and lead to validator comparison, which can yield 304 or 200.

Freshness and validation in the two-clock cache model

A cache is only as coherent as the pair of conditions your headers make explicit.

A cache holding body A sends a conditional GET. The origin returns 304 metadata without content; the cached body A remains available.

Cache headers are a two-way contract with browsers

An origin defines storage and freshness policy; a cache decides whether its stored response can satisfy the next request. When it cannot reuse that response directly, validators can make checking cheaper. These are separate decisions. Finding Cache-Control and ETag in one successful response does not prove that the next request follows the intended path. ...