CodePark/ questions / Headers & HTTP caching
START PRACTICINGPRACTICE
Backend question · HTTP & API design › Headers & HTTP caching

What is the difference between Cache-Control: no-cache and Cache-Control: no-store?

no-cache means "store it, but check with the server before each reuse". no-store means "never store it".

no-cache does not mean "do not cache". A cache may store the response. But it must revalidate it with the origin server before every reuse. Revalidate means "ask the server if the copy is still current". With an ETag or Last-Modified header, this check is cheap. The server answers 304 Not Modified, and the cache reuses the stored body.

no-store means no cache may store the response at all. This includes the browser cache and shared caches. Every request goes to the server, and the client downloads the full body again. Use it for sensitive data, such as banking pages or responses with personal information.

Common mistakes:

  • Using no-cache to keep secrets out of caches. The secret still gets stored.
  • Using no-store when you only wanted fresh data. Revalidation with no-cache would have saved bandwidth.

The old Expires header and Pragma: no-cache are legacy. Cache-Control replaces them.

  • no-cache lets a cache store the response, but it must revalidate before each reuse.
  • no-store means the response is never stored.
  • Revalidation uses ETag or Last-Modified and can return 304.
  • Use no-store for sensitive data.