HTTP-кэширование (Cache-Control, ETag): как это работает на практике

Question

Accepted Answer

`Cache-Control` — freshness rules; `ETag` — cheap revalidation. Hashed statics cache forever; HTML/API — `no-cache` + strong ETag.

## Разбор

**`Cache-Control` directives:**

| Directive | Meaning |
|---|---|
| `max-age=31536000` | Fresh year; serve without asking. |
| `no-cache` | **Store, revalidate every use.** *Not* «don't cache». |
| `no-store` | Never write cache (auth, PII). |
| `private` | Browser yes; **CDN no**. |
| `public` | Any cache, even with auth. |
| `immutable` | No revalidate on reload — URL never changes. |
| `stale-while-revalidate=60` | Serve stale, refresh background. |

**Validation.** Server `ETag: "abc123"`. Revalidate: `If-None-Match: "abc123"`. Match → `304`, ~200 bytes not 200KB. `Last-Modified`/`If-Modified-Since` — weaker (1s resolution).

**Two strategies:**

1. **Hashed statics** (`app.a1b2c3.js`): filename = version → `public, max-age=31536000, immutable`. Deploy = new URL.
2. **HTML/API** stable URL: `no-cache` + strong `ETag` → cheap `304` when unchanged.

## Итог

Freshness (`max-age`) и validation (`ETag`) orthogonal — layer both for 90% web caching wins.

Directive	Meaning
`max-age=31536000`	Fresh year; serve without asking.
`no-cache`	Store, revalidate every use. Not «don't cache».
`no-store`	Never write cache (auth, PII).
`private`	Browser yes; CDN no.
`public`	Any cache, even with auth.
`immutable`	No revalidate on reload — URL never changes.
`stale-while-revalidate=60`	Serve stale, refresh background.

Directive	Meaning
`max-age=31536000`	Fresh year; serve without asking.
`no-cache`	Store, revalidate every use. Not «don't cache».
`no-store`	Never write cache (auth, PII).
`private`	Browser yes; CDN no.
`public`	Any cache, even with auth.
`immutable`	No revalidate on reload — URL never changes.
`stale-while-revalidate=60`	Serve stale, refresh background.