Card 05/ 11
no-cache Does Not Mean Do Not Cache
no-cache stores the response and checks with the server before every use; no-store is the one that keeps nothing.
Cache-Control: no-cache allows a cache to store the response, and requires it to revalidate with the server before every use. The directive that forbids storing is no-store. A response holding secrets marked only no-cache is written to disk by browsers and proxies, which is what its author was trying to prevent.
The symptom. A security review finds account statements or tokens in a browser's disk cache or a proxy's store, though every response carried no-cache.
no-cachestored, then checked each time
The browser writes the statement to its cache. On the next visit it sends If-None-Match, and shows the stored copy after a 304. The statement stays on disk after the user signs out.
no-storenever stored
No cache keeps any copy. Every visit downloads the statement again, and nothing remains on the device or in a proxy.
Why it happens. The name. "No cache" reads as an instruction not to cache, and it was even treated that way by some old proxies. The standard has always meant "do not use without checking".
What it costs. Sensitive data at rest on shared computers, in corporate proxies and in backups of browser profiles, outside the API's control.
What to do. Use no-store for anything that must not be kept: tokens, card details, personal documents. Use no-cache for data that must always be current but is harmless to store, where the 304 still saves bandwidth. Add private to personal data either way, so a shared cache never holds it.
← → move through sections and cards