Visual RFC.
ALL RFCs / RFC 8674
Read the RFC ↗
RFC 8674 / CACHE AND TRUST BOUNDARIES

Keep cache variants apart

04

When a cacheable response can change with Prefer, caches need that field in Vary on both preferred and default responses. A private response is an alternative for preventing shared storage.

DIAGRAMRead RFC section 2 ↗
RFC 8674 · § 2EXAMPLE
3 / 3
Keep cache variants apartTwo independent eligible GET-response examples for the same URI both carry Vary: Prefer. The first original request had safe and the second had no Prefer field; those nominated values do not match for cache reuse without revalidation. Other Prefer values are not automatically equivalent. The last alternative policy delivers a private response while stopping shared storage only; private client caching can remain permitted under applicable rules.Variants for the same GET URIOriginClientresponse arrivesCache-Control: privateshared storagePrivate cache may still store itNot no-store · not encryption or access control
03
Compare an alternative to shared caching.

The response is delivered to the client. Shared storage stops at a separate gate; a private browser cache may still store it under applicable rules. No no-store or confidentiality guarantee is implied.

Source for this drawing: RFC 8674 · Read RFC section 2 ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A message needs an address.

Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.

Helpful first, if these ideas are unfamiliar

RFC 9110 HTTP RFC 9111 Caching

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Terms in this drawing
Vary
A response field identifying request fields that affect selection of a stored response.
Private cache
A cache dedicated to a single user, unlike a shared intermediary cache.
Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

Separate response variants or prevent shared caching of the varying response.

  • RFC 8674 points to RFC 7240 §2: when optional preference application changes cache handling, Vary must identify Prefer even on a response to a request that omitted it. Do not add Vary only to the safer response.
  • Vary: Prefer nominates the Prefer request field, not merely the presence of any preference. RFC 9111 §4.1 requires matching nominated values for reuse without revalidation; an absent field matches another absent field.
  • Appendix B offers making varying responses uncacheable by shared caches, for example Cache-Control: private. Private permits a private cache under applicable rules; it is not no-store, encryption or an access-control guarantee.
DETAILS

The two public variants are separate eligible GET responses for the same URI. Other storage, freshness and revalidation rules still apply. The private state is an alternative response policy, not an extra cache key and not a promise that all caches erase existing data.

Read the RFC section ↗

All chapters in RFC 8674

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗