HTTP Caching
How Cache-Control, ETag, Last-Modified, and If-None-Match headers let browsers and intermediaries reuse responses, saving bandwidth and load.
HTTP caching lets a client or an intermediary reuse a stored response instead of asking the origin server again. Done well, it turns repeated reads into near-zero-cost operations: the browser serves the page from its local cache, or a CDN answers without contacting the server at all. The mechanism is entirely controlled by response headers, so caching is a contract between the server and every cache along the path — HTTP and HTTPS define the field names, and cache correctness depends on servers setting them truthfully.
Two complementary mechanisms exist. Expiration-based caching uses Cache-Control: max-age=3600 (or the legacy Expires header) to state how long a response may be reused without asking the origin. Validation-based caching keeps the response but requires revalidation before reuse: the server sends an ETag (a version fingerprint) or Last-Modified date, and the client sends If-None-Match or If-Modified-Since; if nothing changed, the server replies 304 Not Modified with no body, which is much cheaper than a full 200 response.
HTTP/1.1 200 OK
Cache-Control: public, max-age=300
ETag: "a1b2c3"
Last-Modified: Mon, 12 Aug 2026 09:00:00 GMT
Cache-Control also distinguishes private caches (browser only, for personalized content) from public ones (browsers plus shared caches and CDNs), and no-store disables caching entirely for sensitive data. The Vary header tells caches that responses differ by a request header such as Accept-Encoding or Accept-Language, preventing one variant from being served to everyone. Two pitfalls dominate: caching personalized or authenticated content in a shared cache (a privacy leak), and stale content surviving because no-cache or short max-age was not set. In RESTful APIs, GET responses that are immutable or slowly changing should be explicitly cacheable, and cache busting — versioned filenames like app.v2.js — makes long-lived caching safe for static assets.
Tags
Related articles
- HTTP and HTTPS
- How TLS Works: The HTTPS Handshake Explained
- RESTful APIs
- Big O Notation
- SQL Indexes and Query Performance
- TCP Congestion Control