Caching and Performance Engineering · Caching Fundamentals
HTTP Caching and CDNs
Cache-Control, ETags and edge caching for pages and APIs.
Cache-Control drives HTTP caches: public/private, max-age (browser) and s-maxage (shared caches/CDN), no-cache (store but revalidate), no-store (never store), immutable, and stale-while-revalidate. Validators (ETag, Last-Modified) enable conditional requests returning 304 Not Modified. CDNs cache at the edge by URL plus Vary headers; purge by URL or surrogate keys/tags on changes.
# Fingerprinted asset
Cache-Control: public, max-age=31536000, immutable
# Public product page
Cache-Control: public, max-age=0, s-maxage=60, stale-while-revalidate=300
Surrogate-Key: product-42 category-7 (CDN purge by tag)
# User-specific API response
Cache-Control: private, no-cache
ETag: "v7-9f2c"
# Sensitive data (account details, tokens)
Cache-Control: no-store
Common pitfalls
- Caching responses that set cookies or depend on auth in a CDN.
- Missing
Vary: Accept-Encoding/Accept-Languagewhere responses differ. - Long max-age on non-fingerprinted URLs (users stuck with old files).
Key points
- max-age vs s-maxage
- ETags for cheap revalidation
- Purge by tags on change
Further reading: MDN: Cache-Control
Practice questions
What's the difference between no-cache and no-store?
Answer
no-cache allows storing but requires revalidation with the origin before each use; no-store forbids storing the response anywhere.
Why use s-maxage separately from max-age?
Answer
It lets shared caches like CDNs keep content for a different (often longer) time than browsers, while purges keep the CDN fresh.
Open in the app to mark lessons complete, take notes and track your progress.