No-cache is not no-store

0:00SarahRoger, a question for every web developer listening. You put no-cache on a response. Did you just tell the cache not to keep it?

0:08RogerMost people think so. Today we find out what you actually told it.

0:13RogerQuick housekeeping first. We're both synthetic voices, the music is generated too, and so is this show. The answers aren't invented, though. Every result you'll hear comes from a recorded Arxo run, and the facts and hashes for each one are in the show notes.

0:31SarahShow notes. Got it.

0:34RogerThis is Executable Knowledge: Cases.

0:39RogerPicture yourself setting cache headers for a site. Two directives look almost identical: no-cache and no-store. The rules come from RFC 9111, the HTTP caching standard. We loaded the two sections that matter into a small Arxo package, and we'll hand it five cases.

0:59SarahWhat does a cache do by default?

1:02RogerEvery response here is a plain GET that came back 200. By default the cache may keep it, and reuse it while it's fresh. The package even calls that rule reuse while fresh.

1:15SarahStart easy, then.

1:16RogerThe home page. Fresh, and sent without any directives.

1:22Arxo answerResult: true. Rule applied: Reuse While Fresh.

1:28SarahA yes, from the rule you just named.

1:31RogerNow the news page. Also fresh. But it was sent with no-cache.

1:36SarahAnd this is where I'd say: no-cache, so it isn't cached at all. Right?

1:43Arxo answerResult: false.

1:45RogerNo reuse. So you're half right. But listen to how it lost.

1:51Arxo answerReuse While Fresh is defeated by No Cache Needs Validation, by priority.

1:57SarahSo the reuse rule actually fired... and then lost?

2:01RogerIt fired, and it was defeated by priority. And the rule that beat it says what it wants, right in its name.

2:09Arxo answerRule applied: No Cache Needs Validation.

2:13SarahNo cache needs validation. So not never. Just not without asking first.

2:19RogerExactly. Not without checking with the origin server first.

2:24SarahSo what happens when the cache does check?

2:27RogerThat's the prices page. No-cache again, but this time the cache has validated the response with the origin.

2:36Arxo answerResult: true. Rule applied: Reuse After Validation.

2:42SarahBack to yes.

2:43RogerAnd this one stacks two priorities. Listen.

2:47Arxo answerNo Cache Needs Validation is defeated by Reuse After Validation, by priority. Reuse While Fresh is defeated by No Cache Needs Validation, by priority.

3:00RogerValidation beats no-cache. No-cache beats plain freshness. That's all no-cache ever said: reuse, but only after validation.

3:11SarahOkay. Then what's no-store for?

3:14RogerA different kind of answer entirely. A proxy receives a private account page, sent with no-store. Nothing gets switched off here. The package sets up a prohibition, addressed to the proxy, from the day the response arrived.

3:29Arxo answerProhibition: store response, on the proxy. Status: active.

3:36SarahActive. So nothing has gone wrong yet.

3:39RogerNothing yet. Last case. Same proxy, same page, and a record showing the proxy stored it anyway.

3:49Arxo answerProhibition: store response, on the proxy. Status: violated.

3:56SarahViolated.

3:57RogerViolated, and the answer names who was bound by it: the proxy. That's the difference in one line. No-cache is about when a cache may reuse a response. No-store makes storing it a breach.

4:12SarahSo no-cache means not without asking. And no-store means someone is on the hook.

4:19RogerBefore you pick a directive, name the action you want to control: keeping the response, or using it again. Five cases, each with the rule that decided it. The facts, the full answers and the hashes are in the show notes.

4:34SarahNext time: castling through a square nobody checked.

4:38RogerBoth voices synthetic, every answer from a real run. This was Executable Knowledge: Cases, from Arxo.