Recently I found that our web app sends the following headers:
Expires: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
This is how I read it:
Expires: 0
"Hey browser, the resource you just got has already expired"
Cache-Control: [..] max-age=0 [..]
"Actually nevermind what I just said, please do the following:"
no-cache
"Please cache this resource. But it's already stale, so please revalidate it before using"
no-store
"Also please do not cache anything"
max-age=0, must-revalidate
"Also please cache this resource. But if you want to use it after 0 seconds has passed - please revalidate it."
There can be 2 explanations to this:
- The person writing it didn't know what they were doing
- They actually knew it very well. I.e. they catered to some edge-case browser behavior / bugs / something that I am missing.
What exactly they might have tried to avoid?
Bonus question 1: is my understanding correct that Expires: 0
is (rough, with caveats) equivalent of no-cache
rather than no-store
? I.e. it allows caching but the caches become stale immediately - it does not prevent caching?
Bonus question 2: shouldn't I add proxy-revalidate
?