Cache-Control carries caching instructions as comma-separated directives. max-age=60 says the response is fresh for a minute; no-store forbids storing it at all; private allows only the user's own browser to keep it; public allows shared caches; no-cache allows storing but requires revalidation before every reuse.
A cache serves a fresh response without contacting the server. Once it is stale, the cache revalidates with a conditional request — If-None-Match with the stored ETag — and the server answers 304 Not Modified if nothing changed, saving the body. s-maxage sets a separate lifetime for shared caches such as CDNs.
That no-cache means "do not cache". It means "check with me before using a cached copy"; the directive that forbids storage is no-store. Mixing them up either leaks private data into shared caches or throws away caching that was safe.
GET /football/v1/standings and GET /bank/v1/exchange-rates both send Cache-Control with an ETag; repeat the request with If-None-Match set to that ETag and the answer is a bodiless 304.
All glossary terms · Testing techniques · All 39 mock REST APIs
Last updated