Revision 1129173 of Cache-Control

<div>{{HTTPSidebar}}</div>

<p>The&nbsp;<strong><code>Cache-Control</code></strong> general-header field is used to specify directives for caching mechanisms in both, requests and responses. Caching directives are unidirectional, meaning that a given directive in a request is not implying that the same directive is to be given in the response.</p>

<table class="properties">
 <tbody>
  <tr>
   <th scope="row">Header type</th>
   <td>{{Glossary("General header")}}</td>
  </tr>
  <tr>
   <th scope="row">{{Glossary("Forbidden header name")}}</th>
   <td>no</td>
  </tr>
  <tr>
   <th scope="row">{{Glossary("Simple response header", "CORS-safelisted response-header")}}</th>
   <td>yes</td>
  </tr>
 </tbody>
</table>

<h2 id="Syntax">Syntax</h2>

<p>The directives are case-insensitive and have an optional argument, that can use both token and quoted-string syntax. Multiple directives are comma-separated.</p>

<h3 id="Cache_request_directives">Cache request directives</h3>

<p>Standard <code>Cache-Control</code> directives that can be used by the client in an HTTP request.</p>

<pre class="syntaxbox">
Cache-Control: max-age=&lt;seconds&gt;
Cache-Control: max-stale[=&lt;seconds&gt;]
Cache-Control: min-fresh=&lt;seconds&gt;
Cache-control: no-cache 
Cache-control: no-store
Cache-control: no-transform
Cache-control: only-if-cached
</pre>

<h3 id="Cache_response_directives">Cache response directives</h3>

<p>Standard <code>Cache-Control</code> directives that can be used by the server in an HTTP response.</p>

<pre class="syntaxbox">
Cache-control: must-revalidate
Cache-control: no-cache
Cache-control: no-store
Cache-control: no-transform
Cache-control: public
Cache-control: private
Cache-control: proxy-revalidate
Cache-Control: max-age=&lt;seconds&gt;
Cache-control: s-maxage=&lt;seconds&gt;
</pre>

<h3 id="Extension_Cache-Control_directives">Extension <code>Cache-Control</code> directives</h3>

<p>Extension <code>Cache-Control</code> directives are not part of the core HTTP caching standards document. Be sure to check the <a href="#Browser_compatibility">compatibility table</a> for their support.</p>

<pre class="syntaxbox">
Cache-control: immutable 
Cache-control: stale-while-revalidate=&lt;seconds&gt;
Cache-control: stale-if-error=&lt;seconds&gt;
</pre>

<h2 id="Directives">Directives</h2>

<h3 id="Cacheability">Cacheability</h3>

<dl>
 <dt><code>public</code></dt>
 <dd>Indicates that the response may be cached by any cache.</dd>
 <dt><code>private</code></dt>
 <dd>Indicates that the response is intended for a single user and must not be stored by a shared cache. A private cache may store the response.</dd>
 <dt><code>no-cache</code></dt>
 <dd>Forces caches to submit the request to the origin server for validation before releasing a cached copy.</dd>
 <dt><code>only-if-cached</code></dt>
 <dd>Indicates to not retrieve new data. The client only wishes to obtain a cached response, and should not contact the origin-server to see if a newer copy exists.</dd>
</dl>

<h3 id="Expiration">Expiration</h3>

<dl>
 <dt><code>max-age=&lt;seconds&gt;</code></dt>
 <dd>Specifies the maximum amount of time a resource will be considered fresh. Contrary to <code>Expires</code>, this directive is relative to the time of the request.</dd>
 <dt><code>s-maxage=&lt;seconds&gt;</code></dt>
 <dd>Overrides <code>max-age</code> or the <code>Expires</code> header, but it only applies to shared caches (e.g., proxies) and is ignored by a private cache.</dd>
 <dt><code>max-stale[=&lt;seconds&gt;]</code></dt>
 <dd>Indicates that the client is willing to accept a response that has exceeded its expiration time. Optionally, you can assign a value in seconds, indicating the time the response must not be expired by.</dd>
 <dt><code>min-fresh=&lt;seconds&gt;</code></dt>
 <dd>Indicates that the client client wants a response that will still be fresh for at least the specified number of seconds.</dd>
 <dt><code>stale-while-revalidate=&lt;seconds&gt;</code> {{experimental_inline}}</dt>
 <dd>...</dd>
 <dt><code>stale-if-error=&lt;seconds&gt;</code> {{experimental_inline}}</dt>
 <dd>...</dd>
</dl>

<h3 id="Revalidation_and_reloading">Revalidation and reloading</h3>

<dl>
 <dt><code>must-revalidate</code></dt>
 <dd>The cache must verify the status of the stale resources before using it and expired ones should not be used.</dd>
 <dt><code>proxy-revalidate</code></dt>
 <dd>Same as <code>must-revalidate</code>, but it only applies to shared caches (e.g., proxies) and is ignored by a private cache.</dd>
 <dt><code>immutable</code> {{experimental_inline}}</dt>
 <dd>Indicates that the response body will not change over time. The resource, if unexpired, is unchanged on the server and therefore the client should not send a conditional revalidation for it (e.g. <code>If-None-Match</code> or <code>If-Modified-Since</code>) to check for updates. Clients that aren't aware of this extension must ignore them as per the HTTP specification. In Firefox, <code>immutable</code> is only honored on <code>https://</code> transactions. For more information, see also this <a href="https://bitsup.blogspot.de/2016/05/cache-control-immutable.html">blog post</a>.</dd>
</dl>

<h3 id="Other">Other</h3>

<dl>
 <dt><code>no-store</code></dt>
 <dd>The cache should not store anything about the client request or server response.</dd>
 <dt><code>no-transform</code></dt>
 <dd>No transformations or conversions should made to the resource. The Content-Encoding, Content-Range, Content-Type headers must not be modified by a proxy. A non- transparent proxy might, for example, convert between image formats in order to save cache space or to reduce the amount of traffic on a slow link. The <code>no-transform</code> directive disallows this.</dd>
</dl>

<h2 id="Examples">Examples</h2>

<h3 id="Preventing_caching">Preventing caching</h3>

<p>To turn off caching, you can send the following directives. In addition, see also the <code>Expires</code> and <code>Pragma</code> headers.</p>

<pre class="brush: bash">
Cache-Control: no-cache, no-store, must-revalidate
</pre>

<h3 id="Caching_static_assets">Caching static assets</h3>

<p>For the files in the application that will not change, you can usually add aggressive caching. This includes static files that are served by the application such as images, CSS files and JavaScript files, for example. In addition, see also the <code>Expires</code> header.</p>

<pre class="brush: bash">
Cache-Control:public, max-age=31536000</pre>

<h2 id="Specifications">Specifications</h2>

<table class="standard-table">
 <tbody>
  <tr>
   <th scope="col">Specification</th>
   <th scope="col">Title</th>
  </tr>
  <tr>
   <td>{{RFC("7234")}}</td>
   <td>Hypertext Transfer Protocol (HTTP/1.1): Caching</td>
  </tr>
  <tr>
   <td>{{RFC("5861")}}</td>
   <td>HTTP Cache-Control Extensions for Stale Content</td>
  </tr>
 </tbody>
</table>

<h2 id="Browser_compatibility">Browser compatibility</h2>

<p class="hidden">The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out <a href="https://github.com/mdn/browser-compat-data">https://github.com/mdn/browser-compat-data</a> and send us a pull request.</p>

<p>{{Compat}}</p>

<h2 id="See_also">See also</h2>

<ul>
 <li><a href="/en-US/docs/Web/HTTP/Caching_FAQ">HTTP Caching FAQ</a></li>
 <li>{{HTTPHeader("Age")}}</li>
 <li>{{HTTPHeader("Expires")}}</li>
 <li>{{HTTPHeader("Pragma")}}</li>
</ul>