Private and shared caches
05A browser cache serves one user. A shared cache can answer requests from many users and needs stricter safeguards.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 5.2.2.7 ↗
RFC 9111 · § 5.2.2.7EXAMPLE
3 / 3
03
Reuse only a response eligible for sharing.
A public resource can be shared when key matching, freshness, authentication rules, and other conditions permit.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Do not turn a personalized response into a shared answer.
- Unqualified private forbids shared storage but can permit storage in a private cache.
- public can explicitly allow shared caching, including cases otherwise restricted by Authorization, but does not bypass all reuse conditions.
- s-maxage sets a shared-cache lifetime, overrides max-age/Expires there, and includes proxy-revalidate behavior.
Authorization responses require the explicit permission described in §3.5. Vary and freshness still matter. A private directive controls storage; it is not encryption of the message.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy