Cache-Control: no-cache, no-store and private

Understand the concept

Caching reduces latency and transfer, but incorrect isolation can leak private data. no-store requests no storage. no-cache can allow storage but requires validation before reuse. private distinguishes user-specific storage from shared caches. max-age sets freshness; s-maxage addresses shared caches.

Use deliberate policies for sensitive account responses and never casually mark authenticated JSON public. Request no-cache does not purge all previous copies. Browser, service-worker, framework and CDN caches are separate layers.

Expired freshness requires validation or an explicitly permitted stale path. immutable suits versioned assets, not changing content under an unchanged URL. Correct keys and lifetimes are often better than disabling every cache.