The no-store header, on the other hand, prevents the data from being stored outside of a session, in which case it simply isn’t available for a history mechanism to use. With no-store, if the user ends his session by navigating to another domain and then goes back, the only way for browser to know what to display is to get the initial page again from the server. Clients can use this header when the user requires the response to not only be fresh, but also requires that it won’t be updated for a period of time. The must-understand response directive indicates that a cache should store the response only if it understands the requirements for caching based on status code. If a request doesn’t have an Authorization header, or you are already using s-maxage or must-revalidate in the response, then you don’t need to use public.
What is the difference between no-cache and no-store in Cache-control?
In such a case, you could address the caching needs by using a specific, numbered version of the library, and including the hash of the picture in its URL. Note that the major browsers do not support requests with min-fresh. No-transform indicates that any intermediary (regardless of whether it implements a cache) shouldn’t transform the response contents. Note that s-maxage or must-revalidate also unlock that restriction.
immutable
The no-store response directive indicates that any caches of any kind (private or shared) should not store this response. Client would ask server if it has new version of data using those headers and if the answer is no it will serve cached data. If you don’t add a Cache-Control header because the response is not intended to be cached, that could cause an unexpected result.
It stores a single response and reuses it with multiple users — so developers should avoid storing personalized contents to be cached in the shared cache. If you forget to add private to a response with personalized content, then that response can be stored in a shared cache and end up being reused for multiple users, which can cause personal information to leak. There are no cache directives for clearing already-stored responses from caches on intermediate servers. The stale-if-error response directive indicates that the cache can reuse a stale response when an upstream server generates an error, or when the error is generated locally. Here, an error is considered any response with a status code of 500, 502, 503, or 504.
private
Note that the major browsers do not support requests with max-stale. After the FX choice Review stale-if-error period passes, the client will receive any error generated. If no request happened during that period, the cache became stale and the next request will revalidate normally. Revalidation will make the cache be fresh again, so it appears to clients that it was always fresh during that period — effectively hiding the latency penalty of revalidation from them.
- If copied, the second would overwrite the first and thefourth would overwrite the third because of the http-equivdeclarations AND fail with the W3C validator.
- Thus, the user can navigate backward to a previous page with no-cache without the server being contacted.
- You should always use a real HTTP header for headers such as Cache-Control and Pragma.
- When you use a cache-busting pattern for resources and apply them to a long max-age, you can also add immutable to avoid revalidation.
- Client would ask server if it has new version of data using those headers and if the answer is no it will serve cached data.
Directives
Usually, the revalidation is done through a conditional request. As you identified, no-cache doesn’t mean there is never caching, but rather that the user agent has to always ask the server if it’s OK to use what it cached. By contrast, no-store says to not even keep a copy, which means there’s nothing to ask about. If you know the answer to “Can I reuse this?” is always no, you get a performance boost by skipping cache validation and saving room in the cache for other data. Adding no-cache to the response causes revalidation to the server, so you can serve a fresh response every time — or if the client already has a new one, just respond 304 Not Modified. The no-cache request directive asks caches to validate the response with the origin server before reuse.
When a user reloads the browser, the browser will send conditional requests for validating to the origin server. The public response directive indicates that the response can be stored in a shared cache. Responses for requests with Authorization header fields must not be stored in a shared cache; however, the public directive will cause such responses to be stored in a shared cache. The no-store request directive allows a client to request that caches refrain from storing the request and corresponding response — even if the origin server’s response could be stored. Aside from performance, there is a behavior difference with browser history.
The immutable response directive indicates that the response will not be updated while it’s fresh. No-cache doesn’t mean “don’t cache this” (that would be no-store). No-cache means don’t use this for normal loads unless the resource is revalidated for freshness. However, cacheing headers are unreliable in meta elements; for one, any web proxies between the site and the user will completely ignore them. You should always use a real HTTP header for headers such as Cache-Control and Pragma.
Cache-Control header
The stale-while-revalidate response directive indicates that the cache could reuse a stale response while it revalidates it to a cache. In general, when pages are under Basic Auth or Digest Auth, the browser sends requests with the Authorization header. This means that the response is access-controlled for restricted users (who have accounts), and it’s fundamentally not shared-cacheable, even if it has max-age. The proxy-revalidate response directive is the equivalent of must-revalidate, but specifically for shared caches only. This usually means the response can be reused for subsequent requests, depending on request directives.
When you build static assets with versioning/hashing mechanisms, adding a version/hash to the filename or query string is a good way to manage caching. If you don’t want a response stored in caches, use the no-store directive. For example, a request with the header above indicates that the browser will accept a stale response from the cache that has expired within the last hour.
Many browsers use this directive for reloading, as explained below. This feature is well established and works across many devices and browser versions. By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy. This page was last modified on Jul 4, 2025 by MDN contributors. Must-understand should be coupled with no-store for fallback behavior.
- For content that’s generated dynamically, or that’s static but updated often, you want a user to always receive the most up-to-date version.
- As you identified, no-cache doesn’t mean there is never caching, but rather that the user agent has to always ask the server if it’s OK to use what it cached.
- Clients can use this header when the origin server is down or too slow and can accept cached responses from caches even if they are a bit old.
- These are completely outdated when using modern up to date browsers.After IE9 anyway.
- It does this by requiring caches to revalidate each request with the origin server.
HTTP 1.1 section 13.13 says that “expiration time does not apply to history mechanisms.” The no-cache header describes expiration, and so doesn’t apply to history mechanisms such as the back button. Thus, the user can navigate backward to a previous page with no-cache without the server being contacted. Imagine that clients/caches store a fresh response for a path, with no request flight to the server. The client indicates that an already-cached response should be returned. If a cache has a stored response, even a stale one, it will be returned. If no cached response is available, a 504 Gateway Timeout response will be returned.
Is there a tag to turn off caching in all browsers? duplicate
Clients can use this header when the origin server is down or too slow and can accept cached responses from caches even if they are a bit old. If you want caches to always check for content updates while reusing stored content, no-cache is the directive to use. It does this by requiring caches to revalidate each request with the origin server. The no-cache response directive indicates that the response can be stored in caches, but the response must be validated with the origin server before each reuse, even when the cache is disconnected from the origin server. Cache storage isn’t required to remove stale responses immediately because revalidation could change the response from being stale to being fresh again. Ask the origin server whether or not the stored response is still fresh.
Browsers usually add no-cache to requests when users are force reloading a page. When you use a cache-busting pattern for resources and apply them to a long max-age, you can also add immutable to avoid revalidation. No-cache allows caches to store a response but requires them to revalidate it before reuse. If the sense of “don’t cache” that you want is actually “don’t store”, then no-store is the directive to use. When you update the library or edit the picture, new content should have a new URL, and caches aren’t reused. No-cache allows clients to request the most up-to-date response even if the cache has a fresh response.
If copied, the second would overwrite the first and thefourth would overwrite the third because of the http-equivdeclarations AND fail with the W3C validator. At most, one could haveone of each http-equiv declarations; pragma, cache-control andexpires. These are completely outdated when using modern up to date browsers.After IE9 anyway. Chrome and Firefox specifically does not work with these as you would expect, if at all.