wdiff draft-ietf-httpbis-p6-cache-05.txt draft-ietf-httpbis-p6-cache-06.txt

Network
HTTPbis Working Group R. Fielding, Ed.
Internet-Draft Day Software
Obsoletes: 2616 (if approved) J. Gettys
Intended status: Standards Track One Laptop per Child
Expires: May 20, September 10, 2009 J. Mogul
HP
H. Frystyk
Microsoft
L. Masinter
Adobe Systems
P. Leach
Microsoft
T. Berners-Lee
W3C/MIT
Y. Lafon, Ed.
W3C
J. Reschke, Ed.
greenbytes
November 16, 2008
March 9, 2009

HTTP/1.1, part 6: Caching
draft-ietf-httpbis-p6-cache-05
draft-ietf-httpbis-p6-cache-06

Status of this Memo

By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims

This Internet-Draft is submitted to IETF in full conformance with the
provisions of which he BCP 78 and BCP 79. This document may contain material
from IETF Documents or she is aware
have been IETF Contributions published or will made publicly
available before November 10, 2008. The person(s) controlling the
copyright in some of this material may not have granted the IETF
Trust the right to allow modifications of such material outside the
IETF Standards Process. Without obtaining an adequate license from
the person(s) controlling the copyright in such materials, this
document may not be disclosed, modified outside the IETF Standards Process, and any
derivative works of which he or she becomes
aware will it may not be disclosed, in accordance with Section 6 of BCP 79. created outside the IETF Standards
Process, except to format it for publication as an RFC or to
translate it into languages other than English.

Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.

Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.

The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.

This Internet-Draft will expire on May 20, September 10, 2009.

This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents in effect on the date of
publication of this document (http://trustee.ietf.org/license-info).
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.

Abstract

The Hypertext Transfer Protocol (HTTP) is an application-level
protocol for distributed, collaborative, hypermedia information
systems. HTTP has been in use by the World Wide Web global
information initiative since 1990. This document is Part 6 of the seven-part specification
that defines the protocol referred to as "HTTP/1.1" and, taken
together, obsoletes RFC 2616. Part 6 defines requirements on HTTP
caches and the associated header fields that control cache behavior
or indicate cacheable response messages.

Editorial Note (To be removed by RFC Editor)

Discussion of this draft should take place on the HTTPBIS working
group mailing list (ietf-http-wg@w3.org). The current issues list is
at <http://tools.ietf.org/wg/httpbis/trac/report/11> and related
documents (including fancy diffs) can be found at
<http://tools.ietf.org/wg/httpbis/>.

The changes in this draft are summarized in Appendix B.6. C.7.

Table of Contents

1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.1. Purpose . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 6 5
1.3. Requirements . . . . . . . . . . . . . . . . . . . . . . . 7
2. Notational Conventions and Generic Grammar 6
1.4. Syntax Notation . . . . . . . . . . 8
3. Overview . . . . . . . . . . . 7
1.4.1. Core Rules . . . . . . . . . . . . . . . . 8
3.1. Cache Correctness . . . . . . 7
1.4.2. ABNF Rules defined in other Parts of the
Specification . . . . . . . . . . . . . . 8
3.2. Warnings . . . . . . 7
2. Cache Operation . . . . . . . . . . . . . . . . . . . 9
3.3. Cache-control Mechanisms . . . . 7
2.1. Response Cacheability . . . . . . . . . . . . . 10
3.4. Explicit User Agent Warnings . . . . . 7
2.1.1. Storing Partial and Incomplete Responses . . . . . . . 8
2.2. Constructing Responses from Caches . . . 10
3.5. Exceptions to the Rules and Warnings . . . . . . . . . 8
2.3. Freshness Model . . 11
3.6. Client-controlled Behavior . . . . . . . . . . . . . . . . 11
4. Expiration Model . . . 9
2.3.1. Calculating Freshness Lifetime . . . . . . . . . . . . 10
2.3.2. Calculating Age . . . . . . . . 12
4.1. Server-Specified Expiration . . . . . . . . . . . 11
2.3.3. Serving Stale Responses . . . . 12
4.2. Heuristic Expiration . . . . . . . . . . . 13
2.4. Validation Model . . . . . . . . 13
4.3. Age Calculations . . . . . . . . . . . . . 13
2.5. Request Methods that Invalidate . . . . . . . . 13
4.4. Expiration Calculations . . . . . 14
2.6. Caching Negotiated Responses . . . . . . . . . . . . 15
4.5. Disambiguating Expiration Values . . . . . . . . . . . . . 16
4.6. Disambiguating Multiple 15
2.7. Combining Responses . . . . . . . . . . . . 17
5. Validation Model . . . . . . . . . . . . 16
3. Header Field Definitions . . . . . . . . . . . 17
6. Response Cacheability . . . . . . . . 16
3.1. Age . . . . . . . . . . . . 18
7. Constructing Responses From Caches . . . . . . . . . . . . . . 19
7.1. End-to-end and Hop-by-hop Headers . 17
3.2. Cache-Control . . . . . . . . . . . 19
7.2. Non-modifiable Headers . . . . . . . . . . . 17
3.2.1. Request Cache-Control Directives . . . . . . . 20
7.3. Combining Headers . . . . 18
3.2.2. Response Cache-Control Directives . . . . . . . . . . 20
3.2.3. Cache Control Extensions . . . . . . 21
8. Caching Negotiated Responses . . . . . . . . . 22
3.3. Expires . . . . . . . . 22
9. Shared and Non-Shared Caches . . . . . . . . . . . . . . . . . 23
10. Errors or Incomplete Response Cache Behavior
3.4. Pragma . . . . . . . . . 24
11. Side Effects of GET and HEAD . . . . . . . . . . . . . . . . . 24
12. Invalidation After Updates or Deletions 23
3.5. Vary . . . . . . . . . . . 24
13. Write-Through Mandatory . . . . . . . . . . . . . . . . 24
3.6. Warning . . . 25
14. Cache Replacement . . . . . . . . . . . . . . . . . . . . . . 26
15. 25
4. History Lists . . . . . . . . . . . . . . . . . . . . . . . . 26
16. Header Field Definitions . . . . . . . . 28
5. IANA Considerations . . . . . . . . . . . 27
16.1. Age . . . . . . . . . . 28
5.1. Message Header Registration . . . . . . . . . . . . . . . 28
6. Security Considerations . . 27
16.2. Cache-Control . . . . . . . . . . . . . . . . . 29
7. Acknowledgments . . . . . 27
16.2.1. What is Cacheable . . . . . . . . . . . . . . . . . . 29
16.2.2. What May be Stored by Caches . . . . . . . . . . . . 30
16.2.3. Modifications of the Basic Expiration Mechanism . . . 31
16.2.4. Cache Revalidation and Reload Controls
8. References . . . . . . . 33
16.2.5. No-Transform Directive . . . . . . . . . . . . . . . 35
16.2.6. Cache Control Extensions . . . . 29
8.1. Normative References . . . . . . . . . . 36
16.3. Expires . . . . . . . . . 29
8.2. Informative References . . . . . . . . . . . . . . . . 37
16.4. Pragma . . 30
Appendix A. Compatibility with Previous Versions . . . . . . . . 31
A.1. Changes from RFC 2068 . . . . . . . . . . . . . . . . 38
16.5. Vary . . 31
A.2. Changes from RFC 2616 . . . . . . . . . . . . . . . . . . 31
Appendix B. Collected ABNF . . . . . . . 38
16.6. Warning . . . . . . . . . . . . 31
Appendix C. Change Log (to be removed by RFC Editor before
publication) . . . . . . . . . . . . . 39
17. IANA Considerations . . . . . . . 33
C.1. Since RFC2616 . . . . . . . . . . . . . . 42
17.1. Message Header Registration . . . . . . . . 33
C.2. Since draft-ietf-httpbis-p6-cache-00 . . . . . . . 42
18. Security Considerations . . . . 33
C.3. Since draft-ietf-httpbis-p6-cache-01 . . . . . . . . . . . 34
C.4. Since draft-ietf-httpbis-p6-cache-02 . . . . 42
19. Acknowledgments . . . . . . . 34
C.5. Since draft-ietf-httpbis-p6-cache-03 . . . . . . . . . . . 34
C.6. Since draft-ietf-httpbis-p6-cache-04 . . . . . 43
20. References . . . . . . 35
C.7. Since draft-ietf-httpbis-p6-cache-05 . . . . . . . . . . . 35
Index . . . . . . . . . 43
20.1. Normative References . . . . . . . . . . . . . . . . . . . 43
20.2. Informative References . . 35
Authors' Addresses . . . . . . . . . . . . . . . . 44
Appendix A. Compatibility with Previous Versions . . . . . . . . 44
A.1. Changes from RFC 2068 . . . . . . . . . . . . . . . . . . 44
A.2. Changes from RFC 2616 . . . . . . . . . . . . . . . . . . 45
Appendix B. Change Log (to be removed by RFC Editor before
publication) . . . . . . . . . . . . . . . . . . . . 45
B.1. Since RFC2616 . . . . . . . . . . . . . . . . . . . . . . 45
B.2. Since draft-ietf-httpbis-p6-cache-00 . . . . . . . . . . . 45
B.3. Since draft-ietf-httpbis-p6-cache-01 . . . . . . . . . . . 46
B.4. Since draft-ietf-httpbis-p6-cache-02 . . . . . . . . . . . 46
B.5. Since draft-ietf-httpbis-p6-cache-03 . . . . . . . . . . . 46
B.6. Since draft-ietf-httpbis-p6-cache-04 . . . . . . . . . . . 47
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 49
Intellectual Property and Copyright Statements . . . . . . . . . . 52 38

1. Introduction

HTTP is typically used for distributed information systems, where
performance can be improved by the use of response caches, and
includes a number caches. This
document defines aspects of elements intended to make caching work as well
as possible. Because these elements interact with each other, it is
useful to describe the caching design of HTTP separately. This
document defines aspects of HTTP/1.1 related HTTP/1.1 related to caching and reusing
response messages.

1.1. Purpose

An HTTP cache is a local store of response messages and the subsystem
that controls its message storage, retrieval, and deletion. A cache
stores cacheable responses in order to reduce the response time and
network bandwidth consumption on future, equivalent requests. Any
client or server may include a cache, though a cache cannot be used
by a server that is acting as a tunnel.

Caching would be useless if it did not significantly improve
performance. The goal of caching in HTTP/1.1 is to reuse a prior
response message to satisfy a current request. In some cases, the
existing a
stored response can be reused without the need for a network request,
reducing latency and network round-trips; we use an
"expiration" a "freshness" mechanism is
used for this purpose (see Section 4). 2.3). Even when a new request is
required, it is often possible to reuse all or parts of the payload
of a prior response to satisfy the request, thereby reducing network
bandwidth usage; we use a "validation" mechanism is used for this purpose
(see Section 5). 2.4).

1.2. Terminology

This specification uses a number of terms to refer to the roles
played by participants in, and objects of, HTTP caching.

cacheable

A cache behaves in response is cacheable if a "semantically transparent" manner, with respect cache is allowed to store a particular response, copy of
the response message for use in answering subsequent requests.
Even when its a response is cacheable, there may be additional
constraints on whether a cache can use affects neither the requesting
client nor cached copy to satisfy
a particular request.

explicit expiration time

The time at which the origin server, except to improve performance. When server intends that an entity should
no longer be returned by a cache without further validation.

heuristic expiration time

An expiration time assigned by a cache when no explicit expiration
time is semantically transparent, the client receives exactly the
same available.

age

The age of a response status and payload that is the time since it would have received had its
request been handled directly by was sent by, or
successfully validated with, the origin server.

In an ideal world, all interactions with an HTTP cache would be
semantically transparent. However, for some resources, semantic
transparency

first-hand

A response is first-hand if the freshness model is not always necessary and can be effectively traded
for in use;
i.e., its age is 0.

freshness lifetime

The length of time between the sake generation of bandwidth scaling, disconnected operation, and high
availability. HTTP/1.1 allows origin servers, caches, and clients to
explicitly reduce transparency when necessary. However, because non-
transparent operation may confuse non-expert users a response and might be
incompatible with certain server applications (such as those for
ordering merchandise), the protocol requires that transparency be
relaxed
o only by an its
expiration time.

fresh

A response is fresh if its age has not yet exceeded its freshness
lifetime.

stale

A response is stale if its age has passed its freshness lifetime
(either explicit protocol-level request when relaxed by client or origin server

o only with heuristic).

validator

A protocol element (e.g., an explicit warning to the end user when relaxed by
cache entity tag or client

Therefore, HTTP/1.1 provides these important elements:

1. Protocol features a Last-Modified time)
that provide full semantic transparency when
this is required by all parties.

2. Protocol features that allow an origin server or user agent used to
explicitly request and control non-transparent operation.

3. Protocol features that allow find out whether a stored response is an
equivalent copy of an entity.

shared cache

A cache to attach warnings to
responses that do not preserve the requested approximation of
semantic transparency. is accessible to more than one user. A basic principle non-shared
cache is that it must be possible for the clients dedicated to
detect any potential relaxation of semantic transparency.

Note: a single user.

1.3. Requirements

The server, cache, or client implementor might be faced with
design decisions not explicitly discussed key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this specification.
If a decision might affect semantic transparency, the implementor
ought
document are to err on the side of maintaining transparency unless a
careful and complete analysis shows significant benefits be interpreted as described in
breaking transparency.

1.2. Terminology

This specification uses a number of terms to refer to the roles
played by participants in, and objects of, HTTP caching.

cacheable

A response [RFC2119].

An implementation is cacheable not compliant if a cache is allowed it fails to store a copy satisfy one or more
of the response message for use in answering subsequent requests.
Even when a response is cacheable, there may be additional
constraints on whether a cache can use the cached copy for a
particular request.

first-hand

A response is first-hand if it comes directly and without
unnecessary delay from the origin server, perhaps via one or more
proxies. A response is also first-hand if its validity has just
been checked directly with the origin server.

explicit expiration time

The time at which the origin server intends that an entity should
no longer be returned by a cache without further validation.

heuristic expiration time

An expiration time assigned by a cache when no explicit expiration
time is available.

age

The age of a response is the time since it was sent by, or
successfully validated with, the origin server.

freshness lifetime

The length of time between the generation of a response and its
expiration time.

fresh

A response is fresh if its age has not yet exceeded its freshness
lifetime.

stale

A response is stale if its age has passed its freshness lifetime.

validator

A protocol element (e.g., an entity tag or a Last-Modified time)
that is used to find out whether a cache entry is an equivalent
copy of an entity.

1.3. Requirements

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].

An implementation is not compliant if it fails to satisfy one or more
of the MUST or REQUIRED level requirements MUST or REQUIRED level requirements for the protocols it
implements. An implementation that satisfies all the MUST or
REQUIRED level and all the SHOULD level requirements for its
protocols is said to be "unconditionally compliant"; one that
satisfies all the MUST level requirements but not all the SHOULD
level requirements for its protocols is said to be "conditionally
compliant."

2. Notational Conventions and Generic Grammar

1.4. Syntax Notation

This specification uses the ABNF syntax defined in Section 2.1 1.2 of
[Part1] and (which extends the core rules syntax defined in Section 2.2 of [Part1]:

DIGIT = <DIGIT, [RFC5234] with a list
rule). Appendix B shows the collected ABNF, with the list rule
expanded.

The following core rules are included by reference, as defined in [Part1], Section 2.2>
[RFC5234], Appendix B.1: ALPHA (letters), CR (carriage return), CRLF
(CR LF), CTL (controls), DIGIT (decimal 0-9), DQUOTE = <DQUOTE, defined in [Part1], Section 2.2> (double quote),
HEXDIG (hexadecimal 0-9/A-F/a-f), LF (line feed), OCTET (any 8-bit
sequence of data), SP = <SP, (space), VCHAR (any visible USASCII character),
and WSP (whitespace).

1.4.1. Core Rules

The core rules below are defined in [Part1], Section 2.2> 1.2.2 of [Part1]:

quoted-string = <quoted-string, defined in [Part1], Section 2.2> 1.2.2>
token = <token, defined in [Part1], Section 2.2> 1.2.2>
OWS = <OWS, defined in [Part1], Section 2.2> 1.2.2>

1.4.2. ABNF Rules defined in other Parts of the Specification

The ABNF rules below are defined in other parts:

field-name = <field-name, defined in [Part1], Section 4.2>
HTTP-date = <HTTP-date, defined in [Part1], Section 3.3.1> 3.2.1>
port = <port, defined in [Part1], Section 3.2> 2.1>
pseudonym = <pseudonym, defined in [Part1], Section 8.9>
uri-host = <uri-host, defined in [Part1], Section 3.2>

3. Overview

3.1. 2.1>

2. Cache Correctness Operation

2.1. Response Cacheability

A correct cache MUST respond to NOT store a request with the most up-to-date response held by the cache that is appropriate to the any request, unless:

o The request (see
Sections 4.5, 4.6, method is defined as being cacheable, and 14) which meets one of the following
conditions:

1. It has been checked for equivalence with what the origin server
would have returned by revalidating the response with

o the origin
server (Section 5);

2. It is "fresh enough" "no-store" cache directive (see Section 4). In the default case, this
means it meets the least restrictive freshness requirement of the
client, origin server, 3.2) does not appear
in request or response headers, and

o the "private" cache response directive (see Section 16.2); 3.2 does not
appear in the response, if the
origin server so specifies, it cache is shared, and

o the freshness requirement "Authorization" header (see Section 3.1 of
the origin server alone. If a stored response is [Part7]) does not "fresh
enough" by the most restrictive freshness requirement of both the
client and the origin server,
appear in carefully considered
circumstances the cache MAY still return request, if the response with cache is shared (unless the
appropriate Warning header (see Sections 3.5 and 16.6), unless
such a response "public"
directive is prohibited (e.g., by a "no-store" cache-
directive, or by a "no-cache" cache-request-directive; present; see Section 16.2).

3. It is an appropriate 304 (Not Modified), 305 (Use Proxy), or
error (4xx or 5xx) response message.

If the cache can not communicate with 3.2), and

o the origin server, then a
correct cache SHOULD respond as above understands partial responses, if the response can be
correctly served from the cache; if not it MUST return an error is
partial or
warning indicating incomplete (see Section 2.1.1).

Note that there was in normal operation, most caches will not store a communication failure.

If response
that has neither a cache receives a response (either validator nor an entire response, or a 304
(Not Modified) response) that it would normally forward explicit expiration time,
as such responses are not usually useful to the
requesting client, store. However, caches
are not prohibited from storing such responses.

2.1.1. Storing Partial and the received Incomplete Responses

A cache that receives an incomplete response is no longer fresh, (for example, with fewer
bytes of data than specified in a Content-Length header) can store
the
cache SHOULD forward response, but MUST treat it to as a partial response [Part5].
Partial responses can be combined as described in Section 4 of
[Part5]; the requesting client without adding result might be a new
Warning (but without removing any existing Warning headers). full response or might still be
partial. A cache
SHOULD MUST NOT attempt to revalidate return a partial response simply because that
response became stale in transit; this might lead to an infinite
loop. A user agent that receives a stale response client
without a Warning
MAY display a warning indication to explicitly marking it as such using the user.

3.2. Warnings

Whenever a 206 (Partial Content)
status code.

A cache returns a response that is neither first-hand nor
"fresh enough" (in does not support the sense of condition 2 in Section 3.1), it Range and Content-Range headers
MUST
attach NOT store incomplete or partial responses.

2.2. Constructing Responses from Caches

For a warning to that effect, using presented request, a Warning general-header. cache MUST NOT return a stored response,
unless:

o The
Warning header presented Request-URI and that of the currently defined warnings are described in
Section 16.6. The warning allows clients to take appropriate action.

Warnings MAY stored response match
(see [[anchor1: TBD]]), and

o the request method associated with the stored response allows it
to be used for other purposes, both cache-related the presented request, and
otherwise. The use of a warning, rather than an error status code,
distinguish these responses from true failures.

Warnings are assigned three digit warn-codes. The first digit
indicates whether

o selecting request-headers nominated by the Warning MUST or MUST NOT be deleted from a stored cache entry after a successful revalidation:

1xx Warnings that describe the freshness or revalidation status of response (if
any) match those presented (see Section 2.6), and
o the response, presented request and so MUST be deleted after a successful
revalidation. 1xx warn-codes MAY be generated by a cache only when
validating a cached entry. It MUST NOT be generated by clients.

2xx Warnings stored response are free from directives
that describe some aspect of would prevent its use (see Section 3.2 and Section 3.4), and

o the entity body or entity
headers that stored response is not rectified by either:

* fresh (see Section 2.3), or

* allowed to be served stale (see Section 2.3.3), or

* successfully validated (see Section 2.4).

[[anchor2: TODO: define method cacheability for GET, HEAD and POST in
p2-semantics.]]

When a revalidation (for example, stored response is used to satisfy a
lossy compression of the entity bodies) and which request, caches MUST NOT be
deleted after
include a successful revalidation.

See single Age header field Section 16.6 for the definitions of the codes themselves.

HTTP/1.0 caches will cache all Warnings 3.1 in responses, without
deleting the ones in response with a
value equal to the first category. Warnings in responses stored response's current_age; see Section 2.3.2.
[[anchor3: DISCUSS: this currently includes successfully validated
responses.]]

Requests with methods that are passed unsafe (Section 7.1.1 of [Part2]) MUST
be written through the cache to HTTP/1.0 caches carry an extra warning-date field,
which prevents a future HTTP/1.1 recipient from believing an
erroneously cached Warning.

Warnings also carry the origin server; i.e., A cache must
not reply to such a warning text. The text MAY be in any
appropriate natural language (perhaps based on request before having forwarded the client's Accept
headers), request and include an OPTIONAL indication of what character set is
used.

Multiple warnings MAY be attached to
having received a response (either by corresponding response.

Also, note that unsafe requests might invalidate already stored
responses; see Section 2.5.

Caches MUST use the origin
server or most recent response (as determined by a cache), including multiple warnings with the same code
number. For example, Date
header) when more than one suitable response is stored. They can
also forward a server might provide the same warning request with
texts in both English and Basque.

When multiple warnings are attached to a response, it might not be
practical "Cache-Control: max-age=0" or reasonable to display all of them "Cache-
Control: no-cache" to the user. This
version of HTTP does not specify strict priority rules for deciding disambiguate which warnings response to display use.

[[anchor4: TODO: end-to-end and hop-by-hop headers, non-modifiable
headers removed; re-spec in what order, but does suggest some
heuristics.

3.3. Cache-control Mechanisms

The basic cache mechanisms p1]]

2.3. Freshness Model

When a response is "fresh" in HTTP/1.1 (server-specified expiration
times and validators) are implicit directives the cache, it can be used to caches. In some
cases, a satisfy
subsequent requests without contacting the origin server, thereby
improving efficiency.

The primary mechanism for determining freshness is for an origin
server or client might need to provide an explicit directives
to expiration time in the HTTP caches. We use future, using
either the Cache-Control header for this
purpose.

The Cache-Control Expires header allows a client or server to transmit a
variety of directives in either requests (Section 3.3) or responses. These
directives typically override the default caching algorithms. As a
general rule, if there is any apparent conflict between header
values, the most restrictive interpretation is applied (that is, max-age response cache
directive (Section 3.2.2). Generally, origin servers will assign
future explicit expiration times to responses in the
one belief that the
entity is most not likely to preserve semantic transparency). However,
in some cases, cache-control directives are explicitly specified as
weakening the approximation of semantic transparency (for example,
"max-stale" or "public").

The cache-control directives are described in detail change in Section 16.2.

3.4. Explicit User Agent Warnings

Many user agents make it possible for users to override the basic
caching mechanisms. For example, the user agent might allow a semantically significant way
before the user expiration time is reached.

If an origin server wishes to specify that cached entities (even explicitly stale ones) are
never validated. Or the user agent might habitually add "Cache-
Control: max-stale=3600" force a cache to validate every request. The user agent SHOULD NOT
default to either non-transparent behavior, or behavior that results
in abnormally ineffective caching, but MAY be explicitly configured
to do so by
request, it can assign an explicit action of the user.

If the user has overridden the basic caching mechanisms, the user
agent SHOULD explicitly indicate to the user whenever this results expiration time in the display of information past. This
means that might not meet the server's
transparency requirements (in particular, if the displayed entity response is
known to be stale). Since the protocol normally allows always stale, so that caches should
validate it before using it for subsequent requests. [[anchor5: This
wording may cause confusion, because the user
agent to determine if responses are stale or not, this indication
need only response may still be displayed served
stale.]]

Since origin servers do not always provide explicit expiration times,
HTTP caches may also assign heuristic expiration times when this actually happens. The indication
need they are
not be a dialog box; it could be an icon (for example, a picture
of a rotting fish) or some other indicator.

If the user has overridden the caching mechanisms in a way specified, employing algorithms that would
abnormally reduce the effectiveness of caches, use other header values
(such as the user agent SHOULD
continually indicate this state Last-Modified time) to the user (for example, by a
display of estimate a picture of currency in flames) so that the user plausible expiration
time. The HTTP/1.1 specification does not
inadvertently consume excess resources or suffer from excessive
latency.

3.5. Exceptions provide specific
algorithms, but does impose worst-case constraints on their results.

The calculation to the Rules and Warnings

In some cases, the operator of determine if a cache MAY choose to configure it to
return stale responses even when not requested by clients. This
decision ought not be made lightly, but may be necessary for reasons
of availability or performance, especially when response is fresh is:

response_is_fresh = (freshness_lifetime > current_age)

The freshness_lifetime is defined in Section 2.3.1; the cache current_age
is poorly
connected defined in Section 2.3.2.

Additionally, clients may need to the origin server. Whenever a influence freshness calculation.
They can do this using several request cache returns a stale
response, it MUST mark it as such (using a Warning header) enabling directives, with the client software
effect of either increasing or loosening constraints on freshness.
See Section 3.2.1.

[[anchor6: ISSUE: there are not requirements directly applying to alert the user
cache-request-directives and freshness.]]

Note that there might freshness applies only to cache operation; it cannot be
used to force a potential
problem.

It also allows the user agent to take steps to obtain a first-hand refresh its display or
fresh response. For this reason, reload a
resource. See Section 4 for an explanation of the difference between
caches and history mechanisms.

2.3.1. Calculating Freshness Lifetime

A cache SHOULD NOT return can calculate the freshness lifetime (denoted as
freshness_lifetime) of a stale response if by using the client explicitly requests a first-hand or fresh one,
unless it first match of:

o If the cache is impossible to comply for technical shared and the s-maxage response cache directive
(Section 3.2.2) is present, use its value, or policy reasons.

3.6. Client-controlled Behavior

While

o If the origin server (and to a lesser extent, intermediate caches,
by their contribution to max-age response cache directive (Section 3.2.2) is
present, use its value, or
o If the age of a response) are Expires response header (Section 3.3) is present, use its
value minus the primary
source value of the Date response header, or

o Otherwise, no explicit expiration information, time is present in some cases the client might need
to control a cache's decision about whether to return response,
but a cached
response without validating it. Clients do heuristic may be used; see Section 2.3.1.1.

Note that this using several
directives of the Cache-Control header.

A client's request MAY specify the maximum age it calculation is willing to
accept of an unvalidated response; specifying a value of zero forces
the cache(s) not vulnerable to revalidate clock skew, since all responses. A client MAY also specify
the minimum time remaining before a response expires. Both of these
options increase constraints on the behavior of caches, and so cannot
further relax the cache's approximation of semantic transparency.

A client MAY also specify that it will accept stale responses, up to
some maximum amount
of staleness. This loosens the constraints on
the caches, and so might violate the origin server's specified
constraints on semantic transparency, but might be necessary to
support disconnected operation, or high availability in the face of
poor connectivity.

4. Expiration Model

4.1. Server-Specified Expiration

HTTP caching works best when caches can entirely avoid making
requests to information comes from the origin server. The primary mechanism for avoiding
requests is for an origin server to provide an

2.3.1.1. Calculating Heuristic Freshness

If no explicit expiration time is present in the future, indicating that a stored response MAY be used to satisfy
subsequent requests. In other words, that
has a cache can return status code of 200, 203, 206, 300, 301 or 410, a fresh
response without first contacting the server.

Our expectation is that servers will assign future explicit
expiration times to responses in the belief that the entity is not
likely to change, in a semantically significant way, before the heuristic
expiration time is reached. This normally preserves semantic
transparency, as long as the server's expiration times are carefully
chosen.

The expiration mechanism applies only to responses taken from can be calculated. Heuristics MUST NOT be used for
other response status codes.

When a cache
and not to first-hand responses forwarded immediately heuristic is used to calculate freshness lifetime, the
requesting client.

If an origin server wishes to force a semantically transparent cache
SHOULD attach a Warning header with a 113 warn-code to validate every request, it MAY assign an explicit expiration time
in the past. This means that the response
if its current_age is always stale, more than 24 hours and so such a warning is not
already present.

Also, if the cache SHOULD validate it before using it for subsequent requests.
See Section 16.2.4 for response has a Last-Modified header (Section 6.6 of
[Part4]), the heuristic expiration value SHOULD be no more restrictive way to force revalidation.

If an origin server wishes to force any than some
fraction of the interval since that time. A typical setting of this
fraction might be 10%.

[[anchor7: REVIEW: took away HTTP/1.0 query string heuristic
uncacheability.]]

2.3.2. Calculating Age

HTTP/1.1 cache, no matter how
it is configured, uses the Age response-header to validate every request, it SHOULD use convey the "must-
revalidate" cache-control directive (see Section 16.2).

Servers specify explicit expiration times using either estimated age of
the Expires
header, or response message when obtained from a cache. The Age field value
is the max-age directive cache's estimate of the Cache-Control header.

An expiration amount of time cannot be used to force a user agent to refresh
its display since the response was
generated or reload a resource; its semantics apply only to caching
mechanisms, and such mechanisms need only check a resource's
expiration status when a new request for that resource validated by the origin server. In essence, the Age
value is initiated.
See Section 15 for an explanation the sum of the time that the response has been resident in
each of the difference between caches
and history mechanisms.

4.2. Heuristic Expiration

Since along the path from the origin servers do not always provide explicit expiration times,
HTTP caches typically assign heuristic expiration times, employing
algorithms that use other header values (such as server, plus the Last-Modified
time) to estimate a plausible expiration time.
amount of time it has been in transit along network paths.

The term "age_value" denotes the value of the Age header, in a form
appropriate for arithmetic operations.

HTTP/1.1
specification does not provide specific algorithms, but does impose
worst-case constraints on their results. Since heuristic expiration
times might compromise semantic transparency, they ought to be used
cautiously, and we encourage requires origin servers to provide explicit
expiration times as much as possible.

4.3. Age Calculations

In order to know if a cached entry is fresh, send a cache needs to know Date header, if
its age exceeds its freshness lifetime. We discuss how to calculate possible,
with every response, giving the latter in time at which the response was
generated (see Section 4.4; this section describes how to calculate 8.3 of [Part1]). The term "date_value"
denotes the age value of a response or cache entry.

In this discussion, we use the Date header, in a form appropriate for
arithmetic operations.

The term "now" to mean means "the current value of the clock at the host
performing the calculation." Hosts that use HTTP, but especially
hosts running origin servers and caches, SHOULD use NTP [RFC1305] or
some similar protocol to synchronize their clocks to a globally
accurate time standard.

HTTP/1.1 requires origin servers to send a Date header, if possible,
with every response, giving the time at which the response was
generated (see Section 8.3 of [Part1]). We use the term "date_value"
to denote the value of the Date header, in a form appropriate for
arithmetic operations.

HTTP/1.1 uses the Age response-header to convey the estimated age of
the response message when obtained from a cache. The Age field value
is the cache's estimate of the amount of time since the response was
generated or revalidated by the origin server.

In essence, the Age value is the sum of the time that the response
has been resident in each of the caches along the path from the
origin server, plus the amount of time it has been in transit along
network paths.

We use the term "age_value" to denote the value of the Age header, in
a form appropriate for arithmetic operations.

A response's age can be calculated in two entirely independent ways:

1. now minus date_value, if the local clock is reasonably well
synchronized to the origin server's clock. If the result is
negative, the result is replaced by zero.

2. age_value, if all of the caches along the response path implement
HTTP/1.1.

Given that we have two independent ways to compute the age of a
response when it is received, we can combine these

These are combined as

corrected_received_age = max(now - date_value, age_value)

and as long as we have either nearly synchronized clocks or all-
HTTP/1.1 paths, one gets a reliable (conservative) result.

Because of network-imposed delays, some significant interval might
pass between the time that a server generates a response and the time
it is received at the next outbound cache or client. If uncorrected,
this delay could result in improperly low ages.

Because the request that resulted in the returned Age value must have
been initiated prior to that Age value's generation, we can correct
for delays imposed by the network by recording the time at which the
request was initiated. Then, when

When an Age value is received, it MUST be interpreted relative to the
time the request was initiated, not the time that the response was
received. This algorithm results in
conservative behavior no matter how much delay is experienced. So,
we compute:

corrected_initial_age = corrected_received_age
+ (now - request_time)

where "request_time" is the time (according to the local clock) when
the request that elicited this response was sent.

Summary

The current_age of age calculation algorithm, when a cache receives a
response:

/*
* age_value
* is the value of Age: header received stored response can then be calculated by adding
the cache with
* this response.
* date_value
* is the value amount of time (in seconds) since the stored response was last
validated by the origin server's Date: server to the corrected_initial_age.

In summary:

age_value - Age header
* request_time
* is field-value received with the response
date_value - Date header field-value received with the (local) response
request_time - local time when the cache made the request
* that resulted
resulting in this cached the stored response
*
response_time
* is the (local) - local time when the cache received the
* response
*
now
* is the - current (local) local time
*/

apparent_age = max(0, response_time - date_value);
corrected_received_age = max(apparent_age, age_value);
response_delay = response_time - request_time;
corrected_initial_age = corrected_received_age + response_delay;
resident_time = now - response_time;
current_age = corrected_initial_age + resident_time;

The current_age of a cache entry

2.3.3. Serving Stale Responses

A "stale" response is calculated by adding the amount
of time (in seconds) since the cache entry was last validated by the
origin server one that either has explicit expiry
information, or is allowed to have heuristic expiry calculated, but
is not fresh according to the corrected_initial_age. When calculations in Section 2.3.

Caches MUST NOT return a stale response if it is
generated from prohibited by an
explicit in-protocol directive (e.g., by a "no-store" or "no-cache"
cache entry, directive, a "must-revalidate" cache-response-directive, or an
applicable "s-maxage" or "proxy-revalidate" cache-response-directive;
see Section 3.2.2).

Caches SHOULD NOT return stale responses unless they are disconnected
(i.e., it cannot contact the cache MUST include origin server or otherwise find a single Age
header field in
forward path) or otherwise explicitly allowed (e.g., the response with max-stale
request directive; see Section 3.2.1).

Stale responses SHOULD have a value equal to Warning header with the 110 warn-code
(see Section 3.6). Likewise, the 112 warn-code SHOULD be sent on
stale responses if the cache entry's
current_age.

The presence of an Age header field in is disconnected.

If a response implies that cache receives a first-hand response is not first-hand. However, the converse is not true, since
the lack of (either an Age header field in a response does not imply entire response,
or a 304 (Not Modified) response) that it would normally forward to
the requesting client, and the received response is first-hand unless all caches along no longer fresh,
the request path are
compliant with HTTP/1.1 (i.e., older HTTP caches did not implement cache SHOULD forward it to the Age header field).

4.4. Expiration Calculations

In order requesting client without adding a
new Warning (but without removing any existing Warning headers). A
cache SHOULD NOT attempt to decide whether validate a response is fresh or stale, we need to
compare its freshness lifetime to its age. The age is calculated as
described simply because that
response became stale in Section 4.3; this section describes how to calculate transit.

2.4. Validation Model

Checking with the
freshness lifetime, and origin server to determine see if a stale or otherwise
unusable cached response has expired. In
the discussion below, the values can be represented in any form
appropriate for arithmetic operations.

We use the term "expires_value" to denote reused is called "validating" or
"revalidating." Doing so potentially avoids the value overhead of
retransmitting the Expires
header. We use the term "max_age_value" to denote an appropriate
value of response body when the number of seconds carried by stored response is valid.

HTTP's conditional request mechanism [Part4] is used for this
purpose. When a stored response includes one or more validators,
such as the "max-age" directive field values of
the Cache-Control an ETag or Last-Modified header in field,
then a validating request SHOULD be made conditional to those field
values.

A 304 (Not Modified) response (see status code indicates that the stored
response can be updated and reused; see Section 16.2.3).

The max-age directive takes priority over Expires, so if max-age is
present in a response, 2.7.

If instead the calculation cache receives a full response (i.e., one with a
response body), it is simply:

freshness_lifetime = max_age_value

Otherwise, if Expires is present in the response, the calculation is:

freshness_lifetime = expires_value - date_value

Note that neither of these calculations is vulnerable used to clock skew,
since all of the information comes from the origin server.

If none of Expires, Cache-Control: max-age, or Cache-Control:
s-maxage (see Section 16.2.3) appears in satisfy the response, request and replace the
response does not include other restrictions on caching, the cache
MAY compute
stored response. [[anchor8: Should there be a freshness lifetime using requirement here?]]
If a heuristic. The cache MUST
attach Warning 113 to any response whose age is more than 24 hours if
such warning has not already been added.

Also, if the receives a 5xx response does have while attempting to validate a Last-Modified time, the heuristic
expiration value SHOULD be no more than some fraction of the interval
since that time. A typical setting of
response, it MAY either forward this fraction might be 10%.

The calculation response to determine the requesting
client, or act as if a response has expired is quite
simple:

response_is_fresh = (freshness_lifetime > current_age)

4.5. Disambiguating Expiration Values

Because expiration values are assigned optimistically, it is possible
for two caches the server failed to contain fresh values for respond. In the same resource that are
different.

If a client performing a retrieval receives latter
case, it MAY return a non-first-hand previously stored response
for a request that was already fresh in its own cache, and the Date
header in its existing cache entry is newer than the Date on the new
response, then (which SHOULD
include the client MAY ignore 111 warn-code; see Section 3.6) unless the response. If so, it MAY
retry stored
response includes the request with a "Cache-Control: max-age=0" "must-revalidate" cache directive (see
Section 16.2), to force a check with 2.3.3).

2.5. Request Methods that Invalidate

Because unsafe methods (Section 7.1.1 of [Part2]) have the origin server.

If a cache has two fresh responses potential
for changing state on the same representation with
different validators, it MUST origin server, intervening caches can use
them to keep their contents up-to-date.

The following HTTP methods MUST cause a cache to invalidate the one with
Request-URI as well as the more recent Date
header. This situation might arise because Location and Content-Location headers (if
present):

o PUT

o DELETE

o POST

An invalidation based on the cache is pooling
responses from other caches, or because a client has asked for URI in a
reload Location or a revalidation Content-Location
header MUST NOT be performed if the host part of an apparently fresh cache entry.

4.6. Disambiguating Multiple Responses

Because a client might that URI differs
from the host part in the Request-URI. This helps prevent denial of
service attacks.

[[anchor9: TODO: "host part" needs to be receiving responses via multiple paths, so specified better.]]

A cache that some responses flow passes through one set of caches and other requests for methods it does not
understand SHOULD invalidate the Request-URI.

Here, "invalidate" means that the cache will either remove all stored
responses flow through a different set related to the Request-URI, or will mark these as "invalid"
and in need of caches, a client might
receive responses in an order different from that mandatory validation before they can be returned in which the origin
server sent them. We would like the client
response to use the most recently
generated response, even if older a subsequent request.

Note that this does not guarantee that all appropriate responses are still apparently
fresh.

Neither the entity tag nor
invalidated. For example, the expiration value can impose an
ordering on responses, since it is possible request that caused the change at the
origin server might not have gone through the cache where a later response
intentionally carries an earlier expiration time. The Date values
are ordered to a granularity
is stored.

[[anchor10: TODO: specify that only successful (2xx, 3xx?) responses
invalidate.]]

2.6. Caching Negotiated Responses

Use of one second.

When a client tries to revalidate server-driven content negotiation (Section 4.1 of [Part3])
alters the conditions under which a cache entry, and can use the response it for
subsequent requests.

When a cache receives contains a Date header request that appears to can be older than satisfied by a stored
response that includes a Vary header field (Section 3.5), it MUST NOT
use that response unless all of the one
for selecting request-headers in the existing entry, then
presented request match the client SHOULD repeat corresponding stored request-headers from
the request
unconditionally, and include

Cache-Control: max-age=0 original request.

The selecting request-headers from two requests are defined to force any intermediate caches match
if and only if the selecting request-headers in the first request can
be transformed to validate their copies directly
with the origin server, selecting request-headers in the second request
by adding or

Cache-Control: no-cache removing linear white space [[anchor11: [ref]]] at
places where this is allowed by the corresponding ABNF, and/or
combining multiple message-header fields with the same field name
following the rules about message headers in Section 4.2 of [Part1].
[[anchor12: DISCUSS: header-specific canonicalisation]]

A Vary header field-value of "*" always fails to force any intermediate caches match, and
subsequent requests to obtain a new copy from that resource can only be properly interpreted
by the origin server.

If no stored response matches, the Date values are equal, then the client cache MAY use either response
(or MAY, if it is being extremely prudent, forward the presented
request a new response).
Servers MUST NOT depend on clients being able to choose
deterministically between responses generated during the same second,
if their expiration times overlap.

5. Validation Model

When a cache has origin server in a stale entry that it would like to use as a
response to a client's conditional request, it first has to check and SHOULD
include all ETags stored with potentially suitable responses in an
If-None-Match request header. If the origin server (or possibly an intermediate cache responds with a fresh response) 304 (Not
Modified) and includes an entity tag or Content-Location that
indicates the entity to
see if its be used, that cached entry is still usable. We call this "validating" response MUST be used to
satisfy the cache entry.

HTTP's conditional request mechanism, defined in [Part4], is presented request, and SHOULD be used to
avoid retransmitting update the response payload when
corresponding stored response; see Section 2.7.

If any of the cached entry stored responses contains only partial content, its
entity-tag SHOULD NOT be included in the If-None-Match header field
unless the request is
valid. When for a cached range that would be fully satisfied by
that stored response.

If a cache receives a successful response includes one or more "cache
validators," such as the whose Content-Location
field values matches that of an ETag or Last-Modified
header field, then a validating GET request SHOULD be made
conditional to those field values. The server checks existing stored response for the conditional
request's validator against same
Request-URI, whose entity-tag differs from that of the current state existing
stored response, and whose Date is more recent than that of the requested
resource and, if they match,
existing response, the server responds with existing response SHOULD NOT be returned in
response to future requests and SHOULD be deleted from the
cache.[[anchor13: DISCUSS: Not sure if this is necessary.]]

2.7. Combining Responses

When a cache receives a 304 (Not Modified) status code response or a 206 (Partial
Content) response, it needs to indicate update the stored response with the
new one, so that the cached updated response can be
refreshed and reused without retransmitting sent to the response payload. client.

If the validator does not match status code is 304 (Not Modified), the current state of cache SHOULD use the requested
resource, then
stored entity-body as the server returns a full response, including payload,
so that updated entity-body. If the request can be satisfied status code is
206 (Partial Content) and the cache entry supplanted
without ETag or Last-Modified headers match
exactly, the need for an additional network round-trip.

6. Response Cacheability

Unless specifically constrained by a cache-control (Section 16.2)
directive, a caching system cache MAY always store a successful combine the stored entity-body in the stored
response with the updated entity-body received in the response and
use the result as the updated entity-body (see Section 10) as a cache entry, MAY return it without validation
if it is fresh, and MAY return it after successful validation. If
there is neither a cache validator nor an explicit expiration time
associated with a 4 of [Part5]).

The stored response headers are used for the updated response, we do not expect it to be cached, but
certain caches MAY violate this expectation (for example, when little
or no network connectivity is available). A client can usually
detect except
that such a response was taken

o any stored Warning headers with warn-code 1xx (see Section 3.6)
MUST be deleted from a cache by comparing the
Date header to stored response and the current time.

Note: some HTTP/1.0 caches are known to violate this expectation
without providing forwarded
response.

o any Warning.

However, in some cases it might stored Warning headers with warn-code 2xx MUST be inappropriate for a cache to
retain an entity, or to return it retained in
the stored response to a subsequent
request. This might be because absolute semantic transparency is
deemed necessary by and the service author, or because of security or
privacy considerations. Certain cache-control directives are
therefore forwarded response.

o any headers provided so that in the server can indicate that certain
resource entities, 304 or portions thereof, are not to be cached
regardless of other considerations.

Note that Section 4.1 of [Part7] normally prevents a shared cache
from saving and returning a response to a previous request if that
request included an Authorization header.

A 206 response received with a status code of 200, 203, 206, 300, 301 or
410 MAY be stored by a cache and used in reply to a subsequent
request, subject to the expiration mechanism, unless a cache-control
directive prohibits caching. However, a cache that does not support MUST replace the Range and Content-Range
corresponding headers MUST NOT cache 206 (Partial
Content) responses. from the stored response.

A response received with any other status code (e.g. status codes 302
and 307) cache MUST NOT be returned also replace any stored headers with corresponding
headers received in a reply to a subsequent request
unless there are cache-control directives or another header(s) that
explicitly allow it. For example, these include the following: an
Expires header (Section 16.3); incoming response, except for Warning headers
as described immediately above. If a "max-age", "s-maxage", "must-
revalidate", "proxy-revalidate", "public" or "private" cache-control
directive (Section 16.2).

7. Constructing Responses From Caches

The purpose of an HTTP cache is to store information received header field-name in the
incoming response to requests for use matches more than one header in responding the stored
response, all such old headers MUST be replaced. It MAY store the
combined entity-body.

[[anchor14: ISSUE: discuss how to future requests. In
many cases, a cache simply returns handle HEAD updates]]

3. Header Field Definitions

This section defines the appropriate parts syntax and semantics of a
response HTTP/1.1 header
fields related to caching.

For entity-header fields, both sender and recipient refer to either
the requester. However, if client or the cache holds server, depending on who sends and who receives the
entity.

3.1. Age

The response-header field "Age" conveys the sender's estimate of the
amount of time since the response (or its validation) was generated
at the origin server. Age values are calculated as specified in
Section 2.3.2.

Age = "Age" ":" OWS Age-v
Age-v = delta-seconds

Age field-values are non-negative decimal integers, representing time
in seconds.

delta-seconds = 1*DIGIT

If a cache entry
based on receives a previous response, value larger than the largest positive integer
it might have to combine parts can represent, or if any of its age calculations overflows, it
MUST transmit an Age header with a field-value of 2147483648 (2^31).
Caches SHOULD use an arithmetic type of at least 31 bits of range.

The presence of an Age header field in a response implies that a new
response with what is held in not first-hand. However, the cache entry.

7.1. End-to-end and Hop-by-hop Headers

For converse is not true, since
HTTP/1.0 caches may not implement the purpose of defining Age header field.

3.2. Cache-Control

The general-header field "Cache-Control" is used to specify
directives that MUST be obeyed by all caches along the request/
response chain. The directives specify behavior of caches and non-caching
proxies, we divide HTTP headers into two categories:

o End-to-end headers, which are transmitted intended to prevent
caches from adversely interfering with the ultimate
recipient of a request or response. End-to-end headers
Cache directives are unidirectional in
responses MUST be stored as part that the presence of a cache entry and MUST be
transmitted
directive in any response formed from a cache entry.

o Hop-by-hop headers, which are meaningful only for a single
transport-level connection, and are request does not stored by imply that the same directive is to
be given in the response.

Note that HTTP/1.0 caches or
forwarded by proxies.

The following HTTP/1.1 headers are hop-by-hop headers:

o Connection

o Keep-Alive

o Proxy-Authenticate

o Proxy-Authorization

o TE
o Trailer

o Transfer-Encoding

o Upgrade

All other headers defined by HTTP/1.1 are end-to-end headers.

Other hop-by-hop headers might not implement Cache-Control and
might only implement Pragma: no-cache (see Section 3.4).

Cache directives MUST be listed in passed through by a Connection header
(Section 8.1 of [Part1]).

7.2. Non-modifiable Headers

Some features proxy or gateway
application, regardless of HTTP/1.1, such as Digest Authentication, depend on their significance to that application,
since the value of certain end-to-end headers. A transparent proxy SHOULD directives might be applicable to all recipients along the
request/response chain. It is not possible to target a directive to
a specific cache.

Cache-Control = "Cache-Control" ":" OWS Cache-Control-v
Cache-Control-v = 1#cache-directive

cache-directive = cache-request-directive
/ cache-response-directive

cache-extension = token [ "=" ( token / quoted-string ) ]

3.2.1. Request Cache-Control Directives

cache-request-directive =
"no-cache"
/ "no-store"
/ "max-age" "=" delta-seconds
/ "max-stale" [ "=" delta-seconds ]
/ "min-fresh" "=" delta-seconds
/ "no-transform"
/ "only-if-cached"
/ cache-extension

no-cache

The no-cache request directive indicates that a stored response
MUST NOT modify an end-to-end header unless be used to satisfy the definition of request without successful
validation on the origin server.

no-store

The no-store request directive indicates that header
requires or specifically allows that.

A transparent proxy a cache MUST NOT modify
store any part of the following fields in a either this request or response, any response to it. This
directive applies to both non-shared and it MUST shared caches. "MUST NOT add any of these fields if not
already present:

o Content-Location

o Content-MD5

o ETag

o Last-Modified

A transparent proxy
store" in this context means that the cache MUST NOT modify any of intentionally
store the following fields information in non-volatile storage, and MUST make a
response:

o Expires

but it MAY add any of these fields if not already present. If an
Expires header is added, it MUST be given a field-value identical
best-effort attempt to
that of remove the Date header in that response.

A proxy MUST information from volatile
storage as promptly as possible after forwarding it.

This directive is NOT modify or add any of the following fields in a
message that contains the no-transform cache-control directive, reliable or in
any request:

o Content-Encoding

o Content-Range
o Content-Type

A non-transparent proxy MAY modify sufficient mechanism for
ensuring privacy. In particular, malicious or add these fields to a message
that does not include no-transform, but if it does so, it MUST add a
Warning 214 (Transformation applied) if one does not already appear
in the message (see Section 16.6).

Warning: unnecessary modification of end-to-end headers compromised caches
might
cause authentication failures if stronger authentication
mechanisms are introduced in later versions of HTTP. Such
authentication mechanisms MAY rely on the values of header fields not listed here. recognize or obey this directive, and communications
networks may be vulnerable to eavesdropping.

max-age

The Content-Length field of a max-age request or response directive indicates that the client is added or deleted
according willing
to accept a response whose age is no greater than the rules specified
time in Section 4.4 of [Part1]. A transparent
proxy MUST preserve the entity-length (Section 4.2.2 of [Part3]) of
the entity-body, although it MAY change seconds. Unless max-stale directive is also included, the transfer-length (Section
4.4 of [Part1]).

7.3. Combining Headers

When a cache makes a validating request
client is not willing to accept a server, and stale response.

max-stale

The max-stale request directive indicates that the server
provides client is
willing to accept a 304 (Not Modified) response or that has exceeded its expiration
time. If max-stale is assigned a 206 (Partial Content)
response, the cache value, then constructs the client is
willing to accept a response to send to that has exceeded its expiration time
by no more than the
requesting client. specified number of seconds. If the status code no value is 304 (Not Modified), the cache uses the entity-
body stored in the cache entry as
assigned to max-stale, then the entity-body client is willing to accept a
stale response of this outgoing
response. If any age. [[anchor15: of any staleness? --mnot]]

min-fresh

The min-fresh request directive indicates that the status code client is 206 (Partial Content) and the ETag
or Last-Modified headers match exactly, the cache MAY combine the
contents stored in the cache entry with
willing to accept a response whose freshness lifetime is no less
than its current age plus the new contents received specified time in seconds. That is,
the client wants a response and use the result as that will still be fresh for at least
the entity-body of this outgoing
response, (see Section 5 specified number of [Part5]). seconds.

no-transform

The end-to-end headers stored in the cache entry are used for the
constructed response, except no-transform request directive indicates that

o any stored Warning headers with warn-code 1xx (see Section 16.6) an intermediate
cache or proxy MUST be deleted from NOT change the cache entry and Content-Encoding, Content-Range
or Content-Type request headers, nor the forwarded request entity-body.

only-if-cached

The only-if-cached request directive indicates that the client
only wishes to return a stored response.

o any If it receives this
directive, a cache SHOULD either respond using a stored Warning headers response
that is consistent with warn-code 2xx MUST be retained in
the cache entry and the forwarded response.

o any end-to-end headers provided in other constraints of the 304 request, or 206 response MUST
replace the corresponding headers from the cache entry.

Unless the cache decides to remove
respond with a 504 (Gateway Timeout) status. If a group of caches
is being operated as a unified system with good internal
connectivity, such a request MAY be forwarded within that group of
caches.

3.2.2. Response Cache-Control Directives

cache-response-directive =
"public"
/ "private" [ "=" DQUOTE 1#field-name DQUOTE ]
/ "no-cache" [ "=" DQUOTE 1#field-name DQUOTE ]
/ "no-store"
/ "no-transform"
/ "must-revalidate"
/ "proxy-revalidate"
/ "max-age" "=" delta-seconds
/ "s-maxage" "=" delta-seconds
/ cache-extension

public

The public response directive indicates that the cache entry, response MAY be
cached, even if it MUST would normally be non-cacheable or cacheable
only within a non-shared cache. (See also
replace Authorization, Section
3.1 of [Part7], for additional details.)

private

The private response directive indicates that the end-to-end headers response message
is intended for a single user and MUST NOT be stored with the by a shared
cache. A private (non-shared) cache entry with
corresponding headers received in MAY store the incoming response, except for
Warning headers as described immediately above. response.

If a header field-
name in the incoming private response matches more than directive specifies one header in or more field-
names, this requirement is limited to the
cache entry, all such old headers field-values associated
with the listed response headers. That is, the specified field-
names(s) MUST NOT be replaced.

In other words, stored by a shared cache, whereas the set
remainder of end-to-end headers received in the
incoming response overrides all corresponding end-to-end headers
stored with the cache entry (except for stored Warning headers with
warn-code 1xx, which are deleted even if not overridden). message MAY be.

Note: this rule allows an origin server to use a 304 (Not
Modified) or a 206 (Partial Content) This usage of the word private only controls where the
response to update any header
associated with a previous may be stored, and cannot ensure the privacy of the
message content.

no-cache

The no-cache response for directive indicates that the same entity or sub-
ranges thereof, although it might not always response MUST
NOT be meaningful or
correct used to do so. satisfy a subsequent request without successful
validation on the origin server. This rule does not allow allows an origin server to
use a 304 (Not Modified) or a 206 (Partial Content)
prevent caching even by caches that have been configured to return
stale responses.

If the no-cache response directive specifies one or more field-
names, this requirement is limited to
entirely delete a header that it had provided the field-values assosicated
with a previous
response.

8. Caching Negotiated Responses

Use of server-driven content negotiation (Section 5.1 of [Part3]), as
indicated by the presence of a Vary header field in a response,
alters listed response headers. That is, the conditions and procedure by which a cache can use specified field-
name(s) MUST NOT be sent in the response for to a subsequent requests. See Section 16.5 for use of request
without successful validation on the
Vary header field by servers.

A origin server. This allows
an origin server SHOULD use the Vary header field to inform a cache prevent the re-use of what
request-header certain header fields were used to select among multiple
representations of in
a cacheable response subject to server-driven
negotiation. The set response, while still allowing caching of header fields named by the Vary field value
is known as the "selecting" request-headers.

When rest of the cache receives a subsequent request whose Request-URI
specifies one
response.

Note: Most HTTP/1.0 caches will not recognize or more cache entries including obey this
directive.

no-store

The no-store response directive indicates that a Vary header field,
the cache MUST NOT use such a cache entry to construct a response to
the new request unless all
store any part of either the selecting request-headers present
in the new immediate request match the corresponding stored request-headers in
the original request.

The selecting request-headers from two requests are defined or response. This
directive applies to match
if both non-shared and only if the selecting request-headers shared caches. "MUST NOT
store" in this context means that the first request can
be transformed to cache MUST NOT intentionally
store the selecting request-headers information in non-volatile storage, and MUST make a
best-effort attempt to remove the second request
by adding information from volatile
storage as promptly as possible after forwarding it.

This directive is NOT a reliable or removing linear white space (LWS) at places where sufficient mechanism for
ensuring privacy. In particular, malicious or compromised caches
might not recognize or obey this
is allowed by the corresponding BNF, and/or combining multiple
message-header fields with the same field name following directive, and communications
networks may be vulnerable to eavesdropping.

must-revalidate

The must-revalidate response directive indicates that once it has
become stale, the rules
about message headers in Section 4.2 of [Part1].

A Vary header field-value of "*" always fails response MUST NOT be used to match and satisfy subsequent
requests without successful validation on that resource can only be properly interpreted by the origin server.

If the selecting request header fields

The must-revalidate directive is necessary to support reliable
operation for certain protocol features. In all circumstances an
HTTP/1.1 cache MUST obey the cached entry do not
match the selecting request header fields of the new request, then must-revalidate directive; in
particular, if the cache MUST NOT use a cached entry to satisfy the request unless
it first relays the new request to cannot reach the origin server in for any
reason, it MUST generate a conditional
request and the server responds with 304 (Not Modified), including an
entity tag or Content-Location that indicates 504 (Gateway Timeout) response.

Servers SHOULD send the entity to be used.

If an entity tag was assigned must-revalidate directive if and only if
failure to validate a cached representation, the
forwarded request SHOULD be conditional and include on the entity tags could result in an If-None-Match header field from all its cache entries for the
resource. This conveys to the server
incorrect operation, such as a silently unexecuted financial
transaction.

proxy-revalidate

The proxy-revalidate response directive has the set of entities currently
held by same meaning as
the cache, so must-revalidate response directive, except that if any one it does not
apply to non-shared caches.

max-age
The max-age response directive indicates that response is to be
considered stale after its age is greater than the specified
number of these entities matches seconds.

s-maxage

The s-maxage response directive indicates that, in shared caches,
the
requested entity, maximum age specified by this directive overrides the server can use maximum
age specified by either the ETag header field in its 304
(Not Modified) response to tell max-age directive or the cache which entry is appropriate.
If Expires
header. The s-maxage directive also implies the entity-tag semantics of the new
proxy-revalidate response matches directive.

no-transform

The no-transform response directive indicates that of an existing
entry, intermediate
cache or proxy MUST NOT change the new Content-Encoding, Content-Range
or Content-Type response SHOULD be used to update the header fields of headers, nor the existing entry, and response entity-body.

3.2.3. Cache Control Extensions

The Cache-Control header field can be extended through the result MUST use of one
or more cache-extension tokens, each with an optional value.
Informational extensions (those that do not require a change in cache
behavior) can be returned to added without changing the client.

If any semantics of other
directives. Behavioral extensions are designed to work by acting as
modifiers to the existing base of cache entries contains only partial content
for the associated entity, its entity-tag SHOULD NOT be included in directives. Both the If-None-Match header field unless new
directive and the request is for a range that
would be fully satisfied by standard directive are supplied, such that entry.

If a cache receives a successful response whose Content-Location
field matches
applications that of an existing cache entry for do not understand the same Request-
URI, whose entity-tag differs from that of new directive will default to
the existing entry, behavior specified by the standard directive, and
whose Date is more recent than those that of
understand the existing entry, new directive will recognize it as modifying the
existing entry SHOULD NOT be returned in response
requirements associated with the standard directive. In this way,
extensions to future requests
and SHOULD the cache-control directives can be deleted from made without
requiring changes to the cache.

9. Shared and Non-Shared Caches

For reasons base protocol.

This extension mechanism depends on an HTTP cache obeying all of security the
cache-control directives defined for its native HTTP-version, obeying
certain extensions, and privacy, ignoring all directives that it is necessary to make does not
understand.

For example, consider a
distinction between "shared" and "non-shared" caches. A non-shared
cache is one hypothetical new response directive called
"community" that is accessible only to acts as a single user. Accessibility
in this case SHOULD be enforced by appropriate security mechanisms.
All other caches are considered modifier to be "shared." Other sections of
this specification place certain constraints on the operation of
shared caches private directive. We
define this new directive to mean that, in order addition to prevent loss of privacy or failure of
access controls.

10. Errors or Incomplete Response Cache Behavior

A any non-shared
cache, any cache that receives an incomplete response (for example, with fewer
bytes is shared only by members of data than specified in a Content-Length header) MAY store
the response. However, the community
named within its value may cache MUST treat this as a partial
response. Partial responses MAY be combined as described in Section
5 of [Part5]; the result might be a full response or might still be
partial. A cache MUST NOT return a partial response response. An origin server
wishing to a client
without explicitly marking it as such, using allow the 206 (Partial
Content) status code. A cache MUST NOT return a partial response
using a status code of 200 (OK).

If a cache receives a 5xx response while attempting UCI community to revalidate use an
entry, it MAY either forward this otherwise private
response to the requesting client,
or in their shared cache(s) could do so by including

Cache-Control: private, community="UCI"
A cache seeing this header field will act as correctly even if the server failed to respond. In cache
does not understand the latter case, community cache-extension, since it
MAY return a previously received response unless the cached entry
includes will also
see and understand the "must-revalidate" cache-control private directive (see
Section 16.2).

11. Side Effects of GET and HEAD

Unless the origin server explicitly prohibits the caching of their
responses, thus default to the application of GET and HEAD methods to any resources
SHOULD NOT have side effects that would lead to erroneous behavior if
these responses are taken from a cache. They MAY still have side
effects, but a safe
behavior.

Unrecognized cache directives MUST be ignored; it is not required to consider such side effects in
its caching decisions. Caches are always expected assumed that any
cache directive likely to observe be unrecognized by an
origin server's explicit restrictions on caching.

We note one exception to this rule: since some applications have
traditionally used GET and HEAD requests with URLs containing a query
part to perform operations HTTP/1.1 cache will
be combined with significant side effects, caches MUST
NOT treat responses to such URIs as fresh unless standard directives (or the server provides
an explicit expiration time. This specifically means that responses
from HTTP/1.0 servers for response's default
cacheability) such URIs SHOULD NOT be taken from a cache.
See Section 8.1.1 of [Part2] for related information.

12. Invalidation After Updates or Deletions

The effect of certain methods performed on a resource at that the origin
server might cause one or more existing cache entries to become non-
transparently invalid. That is, although they might continue to be
"fresh," they do not accurately reflect what behavior will remain minimally
correct even if the origin server would
return for a new request on that resource.

There is no way for HTTP to guarantee that all such cache entries are
marked invalid. For example, the request that caused does not understand the change at extension(s).

3.3. Expires

The entity-header field "Expires" gives the origin server might not have gone through date/time after which the proxy where a cache
entry
response is stored. However, several rules help reduce the likelihood considered stale. See Section 2.3 for further discussion
of erroneous behavior.

In this section, the phrase "invalidate freshness model.

The presence of an entity" means Expires field does not imply that the
cache will either remove all instances of that entity from its
storage, or original
resource will mark these as "invalid" change or cease to exist at, before, or after that
time.

The field-value is an absolute date and time as defined by HTTP-date
in need Section 3.2.1 of a mandatory
revalidation before they can [Part1]; it MUST be returned sent in response to rfc1123-date format.

Expires = "Expires" ":" OWS Expires-v
Expires-v = HTTP-date

For example

Expires: Thu, 01 Dec 1994 16:00:00 GMT

Note: if a subsequent
request.

Some HTTP methods MUST cause response includes a cache to invalidate an entity. This
is either the entity referred to by Cache-Control field with the Request-URI, or by max-
age directive (see Section 3.2.2), that directive overrides the
Location or Content-Location headers (if present). These methods
are:

o PUT

o DELETE

o POST

An invalidation based on
Expires field. Likewise, the URI s-maxage directive overrides Expires
in a Location or Content-Location
header MUST shared caches.

HTTP/1.1 servers SHOULD NOT be performed if send Expires dates more than one year in
the host part of that URI differs
from future.

HTTP/1.1 clients and caches MUST treat other invalid date formats,
especially including the host part value "0", as in the Request-URI. This helps prevent denial of
service attacks.

A cache past (i.e., "already
expired").

3.4. Pragma

The general-header field "Pragma" is used to include implementation-
specific directives that passes through requests for methods it does not
understand SHOULD invalidate any entities referred might apply to by any recipient along the Request-
URI.

13. Write-Through Mandatory
request/response chain. All methods pragma directives specify optional
behavior from the viewpoint of the protocol; however, some systems
MAY require that might behavior be expected to cause modifications to consistent with the
origin server's resources MUST be written through to directives.

Pragma = "Pragma" ":" OWS Pragma-v
Pragma-v = 1#pragma-directive
pragma-directive = "no-cache" / extension-pragma
extension-pragma = token [ "=" ( token / quoted-string ) ]

When the origin
server. This currently includes all methods except for GET and HEAD.
A cache MUST NOT reply to such no-cache directive is present in a request from a client before having
transmitted message, an
application SHOULD forward the request to toward the inbound server, and having received origin server even
if it has a
corresponding response from the inbound server. cached copy of what is being requested. This does not
prevent pragma
directive has the same semantics as the no-cache response directive
(see Section 3.2.2) and is defined here for backward compatibility
with HTTP/1.0. Clients SHOULD include both header fields when a proxy no-
cache from sending request is sent to a 100 (Continue) response before
the inbound server has not known to be HTTP/1.1 compliant.
HTTP/1.1 caches SHOULD treat "Pragma: no-cache" as if the client had
sent its final reply.

The alternative (known "Cache-Control: no-cache".

Note: because the meaning of "Pragma: no-cache" as "write-back" or "copy-back" caching) a response-
header field is not
allowed actually specified, it does not provide a
reliable replacement for "Cache-Control: no-cache" in HTTP/1.1, due to a response.

This mechanism is deprecated; no new Pragma directives will be
defined in HTTP.

3.5. Vary

The "Vary" response-header field's value indicates the difficulty set of providing consistent
updates and
request-header fields that determines, while the problems arising from server, cache, or network
failure prior to write-back.

14. Cache Replacement

If a new cacheable (see Sections 16.2.2, 4.5, 4.6 and 10) response is
received from fresh,
whether a resource while any existing responses for the same
resource are cached, the cache SHOULD is permitted to use the new response to reply to a
subsequent request without validation; see Section 2.6.

In uncacheable or stale responses, the current request. It MAY insert it into cache storage and MAY,
if it meets all other requirements, use it to respond to any future
requests that would previously have caused Vary field value advises the old response
user agent about the criteria that were used to be
returned. If it inserts select the new response into cache storage
representation.

Vary = "Vary" ":" OWS Vary-v
Vary-v = "*" / 1#field-name

The set of header fields named by the
rules in Section 7.3 apply.

Note: Vary field value is known as
the selecting request-headers.

Servers SHOULD include a new Vary header field with any cacheable
response that has an older Date header value than
existing cached responses is not cacheable.

15. History Lists

User agents often have history mechanisms, such as "Back" buttons and
history lists, which can be used subject to redisplay an entity retrieved
earlier in server-driven negotiation. Doing so
allows a session.

History mechanisms and caches are different. In particular history
mechanisms SHOULD NOT try cache to show a semantically transparent view of properly interpret future requests on that resource
and informs the current state user agent about the presence of a negotiation on that
resource. Rather, A server MAY include a history mechanism Vary header field with a non-
cacheable response that is
meant subject to show exactly what server-driven negotiation,
since this might provide the user saw agent with useful information about
the dimensions over which the response varies at the time when of the resource
was retrieved.

By default, an expiration time does
response.

A Vary field value of "*" signals that unspecified parameters not apply
limited to history mechanisms.
If the entity is still in storage, a history mechanism SHOULD display
it even if request-headers (e.g., the entity has expired, unless network address of the user has specifically
configured
client), play a role in the agent to refresh expired history documents.

This selection of the response representation;
therefore, a cache cannot determine whether this response is not to
appropriate. The "*" value MUST NOT be construed to prohibit the history mechanism from
telling the user that generated by a view might proxy server;
it may only be stale.

Note: if history list mechanisms unnecessarily prevent users from
viewing stale resources, this will tend generated by an origin server.

The field-names given are not limited to force service authors the set of standard request-
header fields defined by this specification. Field names are case-
insensitive.

3.6. Warning

The general-header field "Warning" is used to avoid using HTTP expiration controls and cache controls when
they would otherwise like to. Service authors may consider it
important that users not be presented with error messages carry additional
information about the status or
warning messages when they use navigation controls (such as BACK)
to view previously fetched resources. Even though sometimes such
resources ought transformation of a message that
might not be cached, or ought to expire quickly, user
interface considerations may force service authors to resort reflected in the message. This information is typically
used to
other means of preventing warn about possible incorrectness introduced by caching (e.g. "once-only" URLs) in order
not
operations or transformations applied to suffer the effects entity body of improperly functioning history
mechanisms.

16. Header Field Definitions

This section defines the syntax and semantics of HTTP/1.1 header
fields related to caching.

For entity-header fields,
message.

Warnings can be used for other purposes, both sender cache-related and recipient refer to either
the client or the server, depending on who sends and who receives the
entity.

16.1. Age
otherwise. The response-header field "Age" conveys the sender's estimate of the
amount use of time since the response (or its revalidation) was generated
at the origin server. A cached response is "fresh" if its age does
not exceed its freshness lifetime. Age values are calculated as
specified a warning, rather than an error status code,
distinguish these responses from true failures.

Warning headers can in Section 4.3.

Age general be applied to any message, however
some warn-codes are specific to caches and can only be applied to
response messages.

Warning = "Age" "Warning" ":" OWS Age-v
Age-v Warning-v
Warning-v = delta-seconds

Age values are non-negative decimal integers, representing time 1#warning-value

warning-value = warn-code SP warn-agent SP warn-text
[SP warn-date]

warn-code = 3DIGIT
warn-agent = ( uri-host [ ":" port ] ) / pseudonym
; the name or pseudonym of the server adding
; the Warning header, for use in
seconds.

delta-seconds debugging
warn-text = 1*DIGIT

If a cache receives quoted-string
warn-date = DQUOTE HTTP-date DQUOTE

Multiple warnings can be attached to a value larger than response (either by the largest positive integer
it can represent, origin
server or if any of its age calculations overflows, it
MUST transmit an Age header by a cache), including multiple warnings with the same code
number. For example, a value of 2147483648 (2^31). An
HTTP/1.1 server that includes a cache MUST include an Age header
field might provide the same warning with
texts in every response generated from its own cache. Caches both English and Basque.

When this occurs, the user agent SHOULD
use an arithmetic type inform the user of at least 31 bits as many of range.

16.2. Cache-Control

The general-header field "Cache-Control"
them as possible, in the order that they appear in the response. If
it is used not possible to specify
directives that MUST be obeyed by inform the user of all caching mechanisms along of the
request/response chain. The directives specify behavior intended to
prevent caches from adversely interfering with warnings, the request or
response. These directives typically override
user agent SHOULD follow these heuristics:

o Warnings that appear early in the default caching
algorithms. Cache directives are unidirectional response take priority over
those appearing later in that the presence
of a directive response.

o Warnings in a request does not imply the user's preferred character set take priority over
warnings in other character sets but with identical warn-codes and
warn-agents.

Systems that generate multiple Warning headers SHOULD order them with
this user agent behavior in mind. New Warning headers SHOULD be
added after any existing Warning headers.

Warnings are assigned three digit warn-codes. The first digit
indicates whether the same directive Warning is required to be given in the response.

Note deleted from a stored
response after validation:

o 1xx Warnings that HTTP/1.0 caches might not implement Cache-Control describe the freshness or validation status of
the response, and
might only implement Pragma: no-cache (see Section 16.4).

Cache directives so MUST be passed through deleted by a proxy or gateway
application, regardless of their significance to that application,
since the directives might caches after validation.
They MUST NOT be applicable to all recipients along the
request/response chain. It is not possible to specify generated by a cache-
directive for cache except when validating a specific cache.

Cache-Control = "Cache-Control" ":" OWS Cache-Control-v
Cache-Control-v = 1#cache-directive

cache-directive = cache-request-directive
/ cache-response-directive

cache-request-directive =
"no-cache" ; Section 16.2.1
/ "no-store" ; Section 16.2.2
/ "max-age" "=" delta-seconds ; Section 16.2.3, 16.2.4
/ "max-stale" [ "=" delta-seconds ] ; Section 16.2.3
/ "min-fresh" "=" delta-seconds ; Section 16.2.3
/ "no-transform" ; Section 16.2.5
/ "only-if-cached" ; Section 16.2.4
/ cache-extension ; Section 16.2.6

cache-response-directive =
"public" ; Section 16.2.1
/ "private" [ "=" DQUOTE 1#field-name DQUOTE ] ; Section 16.2.1
/ "no-cache" [ "=" DQUOTE 1#field-name DQUOTE ] ; Section 16.2.1
/ "no-store" ; Section 16.2.2
/ "no-transform" ; Section 16.2.5
/ "must-revalidate" ; Section 16.2.4
/ "proxy-revalidate" ; Section 16.2.4
/ "max-age" "=" delta-seconds ; Section 16.2.3
/ "s-maxage" "=" delta-seconds ; Section 16.2.3
/ cache-extension ; Section 16.2.6

cache-extension = token [ "=" ( token / quoted-string ) ]

When a directive appears without any 1#field-name parameter, the
directive applies to
cached entry, and MUST NOT be generated by clients.

o 2xx Warnings that describe some aspect of the entire request entity body or response. When such
entity headers that is not rectified by a
directive appears with validation (for example,
a 1#field-name parameter, it applies only to lossy compression of the named field or fields, entity bodies) and not MUST NOT be deleted
by caches after validation, unless a full response is returned, in
which case they MUST be.

The warn-text SHOULD be in a natural language and character set that
is most likely to be intelligible to the rest of human user receiving the request or
response. This mechanism supports extensibility; implementations of
future versions of HTTP might apply these directives to header fields
not defined in HTTP/1.1.

The cache-control directives decision can be broken down into these general
categories:

o Restrictions based on what are cacheable; these may only be imposed by any available knowledge,
such as the origin server.

o Restrictions on what may be stored by a cache; these may be
imposed by either location of the origin server cache or user, the user agent.

o Modifications of Accept-Language field
in a request, the basic expiration mechanism; these may Content-Language field in a response, etc. The
default language is English and the default character set is ISO-
8859-1 ([ISO-8859-1]).

If a character set other than ISO-8859-1 is used, it MUST be
imposed by either encoded
in the origin server or warn-text using the user agent.

o Controls over cache revalidation and reload; these may only be
imposed by method described in [RFC2047].

If an implementation sends a user agent.

o Control over transformation of entities.

o Extensions message with one or more Warning headers
to the caching system.

16.2.1. What is Cacheable

By default, a response receiver whose version is cacheable if HTTP/1.0 or lower, then the requirements of sender
MUST include in each warning-value a warn-date that matches the
request method, request Date
header fields, and in the response status
indicate that it is cacheable. Section 6 summarizes these defaults
for cacheability. The following Cache-Control response directives
allow message.

If an origin server to override the default cacheability of implementation receives a
response:

public

Indicates message with a warning-value that
includes a warn-date, and that warn-date is different from the response MAY be cached by any cache, even if it
would normally Date
value in the response, then that warning-value MUST be non-cacheable deleted from
the message before storing, forwarding, or cacheable only within a non-
shared cache. (See also Authorization, Section 4.1 using it. (preventing the
consequences of [Part7],
for additional details.)

private

Indicates that naive caching of Warning header fields.) If all or part of
the response message is intended warning-values are deleted for
a single user and this reason, the Warning header
MUST NOT be cached deleted as well.

The following warn-codes are defined by this specification, each with
a shared cache. This
allows an origin server to state that the specified parts of the
response are intended for only one user recommended warn-text in English, and are not a valid
response for requests by other users. A private (non-shared)
cache MAY cache the response.

Note: This usage description of its meaning.

110 Response is stale

SHOULD be included whenever the word private only controls where the returned response may is stale.

111 Revalidation failed

SHOULD be cached, and cannot ensure the privacy of the
message content.

no-cache

If the no-cache directive does not specify a field-name, then included if a cache MUST NOT use the response to satisfy returns a subsequent request
without successful revalidation with the origin server. This
allows an origin server to prevent caching even by caches that
have been configured to return stale responses response because an
attempt to client requests.

If the no-cache directive does specify one or more field-names,
then a cache MAY use validate the response failed, due to satisfy a subsequent request,
subject an inability to any other restrictions on caching. However,
reach the
specified field-name(s) MUST NOT server.

112 Disconnected operation

SHOULD be sent in the response to a
subsequent request without successful revalidation with included if the origin
server. This allows an origin server to prevent cache is intentionally disconnected from
the re-use of
certain header fields in a response, while still allowing caching rest of the rest network for a period of time.

113 Heuristic expiration

SHOULD be included if the response.

Note: Most HTTP/1.0 caches will not recognize or obey this
directive.

16.2.2. What May be Stored by Caches

no-store

The purpose of cache heuristically chose a freshness
lifetime greater than 24 hours and the no-store directive response's age is to prevent the
inadvertent release or retention of sensitive information (for
example, on backup tapes). greater
than 24 hours.

199 Miscellaneous warning

The no-store directive applies warning text can include arbitrary information to the
entire message, and MAY be sent either in presented
to a response human user, or in a
request. If sent in a request, a cache MUST NOT store any part of
either logged. A system receiving this request or any response to it. If sent in a response,
a cache warning MUST
NOT store take any part of either this response or automated action, besides presenting the
request that elicited it. This directive applies warning to both non-
shared and shared caches. "MUST NOT store" in this context means
that
the cache user.

214 Transformation applied

MUST NOT intentionally store be added by an intermediate cache or proxy if it applies any
transformation changing the information content-coding (as specified in
non-volatile storage, and MUST make a best-effort attempt to
remove the information from volatile storage as promptly as
possible after forwarding it.

Even when this directive is associated with a response, users
might explicitly store such a response outside of
Content-Encoding header) or media-type (as specified in the caching
system (e.g., with a "Save As" dialog). History buffers MAY store
such responses as part of their normal operation.

The purpose
Content-Type header) of this directive is to meet the stated requirements
of certain users and service authors who are concerned about
accidental releases of information via unanticipated accesses to
cache data structures. While response, or the use entity-body of the
response, unless this directive might
improve privacy in some cases, we caution that it is NOT Warning code already appears in any
way the
response.

299 Miscellaneous persistent warning

The warning text can include arbitrary information to be presented
to a reliable or sufficient mechanism for ensuring privacy. In
particular, malicious or compromised caches might not recognize human user, or
obey logged. A system receiving this directive, warning MUST
NOT take any automated action.

4. History Lists

User agents often have history mechanisms, such as "Back" buttons and communications networks might
history lists, that can be
vulnerable used to eavesdropping.

16.2.3. Modifications of the Basic Expiration Mechanism

The expiration time of redisplay an entity MAY be specified by the origin
server using the Expires header (see Section 16.3). Alternatively,
it MAY be specified using the max-age directive retrieved
earlier in a response. When
the max-age cache-control directive is present in session.

History mechanisms and caches are different. In particular history
mechanisms SHOULD NOT try to show a cached response, correct view of the response is stale if its current age is greater than the age
value given (in seconds) at the time state
of a new request for that resource. The max-age directive on Rather, a response implies that the
response is cacheable (i.e., "public") unless some other, more
restrictive cache directive history mechanism is also present.

If a response includes both an Expires header and a max-age
directive, meant to show exactly
what the max-age directive overrides user saw at the Expires header, even
if time when the Expires header is more restrictive. This rule allows resource was retrieved.

By default, an
origin server to provide, for a given response, a longer expiration time does not apply to an HTTP/1.1 (or later) cache than to an HTTP/1.0 cache. This
might be useful if certain HTTP/1.0 caches improperly calculate ages
or expiration times, perhaps due to desynchronized clocks.

Many HTTP/1.0 cache implementations will treat an Expires value that
is less than or equal to the response Date value as being equivalent
to the Cache-Control response directive "no-cache". history mechanisms.
If an HTTP/1.1
cache receives such a response, and the response does not include entity is still in storage, a
Cache-Control header field, it history mechanism SHOULD consider display
it even if the response entity has expired, unless the user has specifically
configured the agent to refresh expired history documents.

This is not to be
non-cacheable in order construed to retain compatibility with HTTP/1.0 servers.

Note: An origin server prohibit the history mechanism from
telling the user that a view might wish be stale.

Note: if history list mechanisms unnecessarily prevent users from
viewing stale resources, this will tend to use a relatively new force service authors
to avoid using HTTP expiration controls and cache control feature, such as the "private" directive, on a
network including older caches controls when
they would otherwise like to. Service authors may consider it
important that do users not understand that
feature. The origin server will need to combine the new feature be presented with an Expires field whose value is less than error messages or equal
warning messages when they use navigation controls (such as BACK)
to the
Date value. This will prevent older caches from improperly
caching the response.

s-maxage

If a response includes an s-maxage directive, then for a shared
cache (but view previously fetched resources. Even though sometimes such
resources ought not for a private cache), the maximum age specified by
this directive overrides the maximum age specified by either the
max-age directive be cached, or ought to expire quickly, user
interface considerations may force service authors to resort to
other means of preventing caching (e.g. "once-only" URLs) in order
not to suffer the Expires header. The s-maxage directive
also implies the semantics effects of improperly functioning history
mechanisms.

5. IANA Considerations

5.1. Message Header Registration

The Message Header Registry located at <http://www.iana.org/
assignments/message-headers/message-header-index.html> should be
updated with the proxy-revalidate directive permanent registrations below (see [RFC3864]):

The change controller is: "IETF (iesg@ietf.org) - Internet
Engineering Task Force".

6. Security Considerations

Caches expose additional potential vulnerabilities, since the shared cache must not use
contents of the
entry cache represent an attractive target for malicious
exploitation. Because cache contents persist after it becomes stale to respond to a subsequent an HTTP request
without first revalidating it with the origin server. The
s-maxage directive
is always ignored by a private cache.

Note that most older caches, not compliant with this specification,
do not implement any cache-control directives. An origin server
wishing to use a cache-control directive that restricts, but does not
prevent, caching by complete, an HTTP/1.1-compliant cache MAY exploit attack on the
requirement cache can reveal information long after
a user believes that the max-age directive overrides the Expires header,
and the fact that pre-HTTP/1.1-compliant caches do not observe information has been removed from the
max-age directive.

Other directives allow a user agent to modify the basic expiration
mechanism. These directives MAY be specified on a request:

max-age

Indicates that the client is willing to accept a response whose
age is no greater than the specified time in seconds. Unless max-
stale directive is also included, the client is not willing to
accept a stale response.

min-fresh

Indicates that the client is willing to accept a response whose
freshness lifetime is no less than its current age plus the
specified time in seconds. That is, the client wants a response
that will still be fresh for at least the specified number of
seconds.

max-stale

Indicates that the client is willing to accept a response that has
exceeded its expiration time. If max-stale is assigned a value,
then the client is willing to accept a response that has exceeded
its expiration time by no more than the specified number of
seconds. If no value is assigned to max-stale, then the client is
willing to accept a stale response of any age.

If a
network. Therefore, cache returns a stale response, either because contents should be protected as sensitive
information.

7. Acknowledgments

Much of a max-stale
directive on a request, or because the cache is configured to
override the expiration time content and presentation of a response, the cache MUST attach a
Warning header to the stale response, using Warning 110 (Response caching design is
stale).

A cache MAY be configured due to return stale responses without
validation, but only if this does not conflict with any "MUST"-level
requirements concerning cache validation (e.g., a "must-revalidate"
cache-control directive).

If both the new request
suggestions and the cached entry include "max-age"
directives, then the lesser of the two values is used for determining
the freshness of the cached entry for that request.

16.2.4. Cache Revalidation and Reload Controls

Sometimes a user agent might want or need to insist that a cache
revalidate its cache entry with the origin server (and not just with
the next cache along the path to the origin server), or to reload its
cache entry comments from the origin server. End-to-end revalidation might be
necessary if either the cache or the origin server has overestimated
the expiration time of the cached response. End-to-end reload may be
necessary if the cache entry has become corrupted individuals including: Shel Kaphan,
Paul Leach, Koen Holtman, David Morris, and Larry Masinter.

8. References

8.1. Normative References

[ISO-8859-1]
International Organization for some reason.

End-to-end revalidation may be requested either when the client does
not have its own local cached copy, in which case we call it
"unspecified end-to-end revalidation", or when the client does have a
local cached copy, Standardization,
"Information technology -- 8-bit single-byte coded graphic
character sets -- Part 1: Latin alphabet No. 1", ISO/
IEC 8859-1:1998, 1998.

[Part1] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
and J. Reschke, Ed., "HTTP/1.1, part 1: URIs, Connections,
and Message Parsing", draft-ietf-httpbis-p1-messaging-06
(work in which case we call it "specific end-to-end
revalidation."

The client can specify these three kinds of action using Cache-
Control request directives:

End-to-end reload

The request includes a "no-cache" cache-control directive or, for
compatibility with HTTP/1.0 clients, "Pragma: no-cache". Field
names MUST NOT be included with the no-cache directive progress), March 2009.

[Part2] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
and J. Reschke, Ed., "HTTP/1.1, part 2: Message
Semantics", draft-ietf-httpbis-p2-semantics-06 (work in a
request. The server MUST NOT use a cached copy when responding to
such a request.

Specific end-to-end revalidation

The request includes a "max-age=0" cache-control directive, which
forces each cache along the path to the origin server to
revalidate its own entry, if any, with the next cache or server.
The initial request includes a cache-validating conditional with
the client's current validator.

Unspecified end-to-end revalidation

The request includes "max-age=0" cache-control directive, which
forces each cache along the path to the origin server to
revalidate its own entry, if any, with the next cache or server.
The initial request does not include a cache-validating
conditional; the first cache along the path (if any) that holds a
cache entry for this resource includes a cache-validating
conditional with its current validator.

max-age
When an intermediate cache is forced, by means of a max-age=0
directive, to revalidate its own cache entry,
progress), March 2009.

[Part3] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
and the client has
supplied its own validator in the request, the supplied validator
might differ from the validator currently stored with the cache
entry. In this case, the cache MAY use either validator in making
its own request without affecting semantic transparency.

However, the choice of validator might affect performance. The
best approach is for the intermediate cache to use its own
validator when making its request. If the server replies with 304
(Not Modified), then the cache can return its now validated copy
to the client with a 200 (OK) response. If the server replies
with a new entity J. Reschke, Ed., "HTTP/1.1, part 3: Message Payload
and cache validator, however, the intermediate
cache can compare the returned validator with the one provided Content Negotiation", draft-ietf-httpbis-p3-payload-06
(work in
the client's request, using the strong comparison function. If
the client's validator is equal to the origin server's, then the
intermediate cache simply returns 304 (Not Modified). Otherwise,
it returns the new entity with a 200 (OK) response.

If a request includes the no-cache directive, it SHOULD NOT
include min-fresh, max-stale, or max-age.

only-if-cached

In some cases, such as times of extremely poor network
connectivity, a client may want a cache to return only those
responses that it currently has stored, progress), March 2009.

[Part4] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
and not to reload or
revalidate with the origin server. To do this, the client may
include the only-if-cached directive J. Reschke, Ed., "HTTP/1.1, part 4: Conditional
Requests", draft-ietf-httpbis-p4-conditional-06 (work in a request. If it receives
this directive, a cache SHOULD either respond using a cached entry
that is consistent with the other constraints of the request, or
respond with a 504 (Gateway Timeout) status. However, if a group
of caches is being operated as a unified system with good internal
connectivity, such a request MAY be forwarded within that group of
caches.

must-revalidate

Because a cache MAY be configured to ignore a server's specified
expiration time,
progress), March 2009.

[Part5] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
and because a client request MAY include a max-
stale directive (which has a similar effect), the protocol also
includes a mechanism for the origin server to require revalidation
of a cache entry on any subsequent use. When the must-revalidate
directive is present J. Reschke, Ed., "HTTP/1.1, part 5: Range Requests and
Partial Responses", draft-ietf-httpbis-p5-range-06 (work
in a response received by a cache, that cache
MUST NOT progress), March 2009.

[Part7] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
and J. Reschke, Ed., "HTTP/1.1, part 7: Authentication",
draft-ietf-httpbis-p7-auth-06 (work in progress),
March 2009.

[RFC2047] Moore, K., "MIME (Multipurpose Internet Mail Extensions)
Part Three: Message Header Extensions for Non-ASCII Text",
RFC 2047, November 1996.

[RFC2119] Bradner, S., "Key words for use the entry after it becomes stale to respond in RFCs to a
subsequent request without first revalidating it Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC5234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax
Specifications: ABNF", STD 68, RFC 5234, January 2008.

8.2. Informative References

[RFC1305] Mills, D., "Network Time Protocol (Version 3)
Specification, Implementation", RFC 1305, March 1992.

[RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H.,
Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext
Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.

[RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration
Procedures for Message Header Fields", BCP 90, RFC 3864,
September 2004.

Appendix A. Compatibility with Previous Versions

A.1. Changes from RFC 2068

A case was missed in the origin
server. (I.e., the cache MUST do an end-to-end revalidation every
time, if, based solely on the origin server's Expires or max-age
value, the cached response is stale.)

The must-revalidate directive is necessary Cache-Control model of HTTP/1.1; s-maxage
was introduced to support reliable
operation for certain protocol features. In add this missing case. (Sections 2.1, 3.2).

Transfer-coding and message lengths all circumstances an
HTTP/1.1 cache MUST obey the must-revalidate directive; interact in
particular, if the cache cannot reach the origin server ways that
required fixing exactly when chunked encoding is used (to allow for any
reason, it MUST generate a 504 (Gateway Timeout) response.

Servers SHOULD send the must-revalidate directive if and only if
failure to revalidate a request on the entity could result in
incorrect operation, such as a silently unexecuted financial
transaction. Recipients MUST NOT take any automated action
transfer encoding that
violates this directive, and MUST NOT automatically provide an
unvalidated copy of the entity if revalidation fails.

Although this is may not recommended, user agents operating under
severe connectivity constraints MAY violate this directive but, if
so, MUST explicitly warn the user that an unvalidated response has
been provided. The warning MUST be provided on each unvalidated
access, and SHOULD require explicit user confirmation.

proxy-revalidate

The proxy-revalidate directive has the same meaning as the must-
revalidate directive, except that self delimiting); it does not apply was important
to non-shared
user agent caches. It can be straighten out exactly how message lengths are computed. (see also
[Part1], [Part3] and [Part5]) [[anchor18: This used on a response to an
authenticated request refer to permit the user's cache to store
text about non-modifiable headers, and will have to be updated later return the response without needing
on. --jre]]

Proxies should be able to revalidate it (since
it has already been authenticated once by that user), while still
requiring proxies that service many users add Content-Length when appropriate.
[[anchor19: This used to revalidate each time
(in order refer to make sure that each user has been authenticated).
Note that such authenticated responses also need the public cache
control directive in order to allow them to be cached at all.

16.2.5. No-Transform Directive

no-transform

Implementors of intermediate caches (proxies) text about non-modifiable
headers, and will have found it useful to convert be updated later on. --jre]]

Range request responses would become very verbose if all meta-data
were always returned; by allowing the media type of certain entity bodies. A non-
transparent proxy might, for example, convert between image
formats in order to save cache space or server to reduce the amount of
traffic on a slow link.

Serious operational problems occur, however, when these
transformations are applied to entity bodies intended for certain
kinds of applications. For example, applications for medical
imaging, scientific data analysis and those using end-to-end
authentication, all depend on receiving an entity body that is bit
for bit identical to the original entity-body.

Therefore, if a message includes the no-transform directive, an
intermediate cache or proxy MUST NOT change those only send needed
headers that are
listed in Section 7.2 as being subject to the no-transform
directive. This implies that the cache or proxy MUST NOT change
any aspect of the entity-body that is specified by these headers,
including the value of the entity-body itself.

16.2.6. Cache Control Extensions

The Cache-Control header field a 206 response, this problem can be extended through the use of one
or more cache-extension tokens, each with an optional assigned value.
Informational extensions (those which do avoided.
(Section 2.7)

The Cache-Control: max-age directive was not require a change in
cache behavior) MAY properly defined for
responses. (Section 3.2.2)

Warnings could be added without changing the semantics of other
directives. Behavioral extensions are designed to work by acting as
modifiers to the existing base of cache directives. Both the new
directive and the standard directive are supplied, such that
applications which do cached incorrectly, or not understand the new directive will default
to the behavior specified by the standard directive, updated appropriately.
(Section 2.3, 2.7, 3.2, and those that
understand the new directive will recognize it as modifying the
requirements associated with the standard directive. In this way,
extensions 3.6) Warning also needed to the cache-control directives can be made without
requiring changes to the base protocol.

This extension mechanism depends on an HTTP cache obeying all of the
cache-control directives defined for its native HTTP-version, obeying
certain extensions, and ignoring all directives that it does not
understand.

For example, consider a hypothetical new response directive called
community which acts general
header, as a modifier to the private directive. We
define this new directive to mean that, in addition to any non-shared
cache, any cache which is shared only by members of the community
named within its value PUT or other methods may cache the response. An origin server
wishing to allow the UCI community to use an otherwise private
response in their shared cache(s) could do so by including

Cache-Control: private, community="UCI"

A cache seeing this header field will act correctly even if the cache
does not understand the community cache-extension, since it will also
see and understand the private directive and thus default to the safe
behavior.

Unrecognized cache-directives MUST be ignored; have need for it is assumed that any in requests.

A.2. Changes from RFC 2616

Clarify denial of service attack avoidance requirement.
(Section 2.5)

Appendix B. Collected ABNF

Age = "Age:" OWS Age-v
Age-v = delta-seconds

Cache-Control = "Cache-Control:" OWS Cache-Control-v
Cache-Control-v = *( "," OWS ) cache-directive likely to be unrecognized by an HTTP/1.1 cache will
be combined with standard directives (or the response's default
cacheability) such that the cache behavior will remain minimally
correct even if the cache does not understand the extension(s).

16.3. Expires

The Expires entity-header field gives the date/time after which the
response is considered stale. A stale cache entry may not normally
be returned by a cache (either a proxy cache or a user agent cache)
unless it is first validated with the origin server (or with an
intermediate cache that has a fresh copy of the entity). See
Section 4 for further discussion of the expiration model.

The presence of an Expires field does not imply that the original
resource will change or cease to exist at, before, or after that
time.

The format is an absolute date and time as defined by HTTP-date in
Section 3.3.1 of [Part1]; it MUST be sent in rfc1123-date format. *( OWS "," [ OWS
cache-directive ] )

Expires = "Expires" ":" "Expires:" OWS Expires-v
Expires-v = HTTP-date

An example of its use is

Expires: Thu, 01 Dec 1994 16:00:00 GMT

Note: if a response includes a Cache-Control field with the max-
age directive (see Section 16.2.3), that directive overrides the
Expires field.

HTTP/1.1 clients and caches MUST treat other invalid date formats,
especially including the value "0", as in the past (i.e., "already
expired").

To mark a response as "already expired," an origin server sends an
Expires date that is equal to the Date header value. (See the rules
for expiration calculations

HTTP-date = <HTTP-date, defined in [Part1], Section 4.4.)

To mark a response as "never expires," an origin server sends an
Expires date approximately one year from the time the response is
sent. HTTP/1.1 servers SHOULD NOT send Expires dates more than one
year in the future.

The presence of an Expires header field with a date value of some
time 3.2.1>

OWS = <OWS, defined in the future on a response that otherwise would by default be
non-cacheable indicates that the response is cacheable, unless
indicated otherwise by a Cache-Control header field (Section 16.2).

16.4. Pragma

The general-header field "Pragma" is used to include implementation-
specific directives that might apply to any recipient along the
request/response chain. All pragma directives specify optional
behavior from the viewpoint of the protocol; however, some systems
MAY require that behavior be consistent with the directives. [Part1], Section 1.2.2>

Pragma = "Pragma" ":" "Pragma:" OWS Pragma-v
Pragma-v = 1#pragma-directive *( "," OWS ) pragma-directive *( OWS "," [ OWS
pragma-directive ] )

Vary = "Vary:" OWS Vary-v
Vary-v = "*" / ( *( "," OWS ) field-name *( OWS "," [ OWS field-name
] ) )

Warning = "Warning:" OWS Warning-v
Warning-v = *( "," OWS ) warning-value *( OWS "," [ OWS warning-value
] )

cache-directive = cache-request-directive / cache-response-directive
cache-extension = token [ "=" ( token / quoted-string ) ]
cache-request-directive = "no-cache" / extension-pragma "no-store" / ( "max-age="
delta-seconds ) / ( "max-stale" [ "=" delta-seconds ] ) / (
"min-fresh=" delta-seconds ) / "no-transform" / "only-if-cached" /
cache-extension
cache-response-directive = "public" / ( "private" [ "=" DQUOTE *( ","
OWS ) field-name *( OWS "," [ OWS field-name ] ) DQUOTE ] ) / (
"no-cache" [ "=" DQUOTE *( "," OWS ) field-name *( OWS "," [ OWS
field-name ] ) DQUOTE ] ) / "no-store" / "no-transform" /
"must-revalidate" / "proxy-revalidate" / ( "max-age=" delta-seconds
) / ( "s-maxage=" delta-seconds ) / cache-extension

delta-seconds = 1*DIGIT

extension-pragma = token [ "=" ( token / quoted-string ) ]

When the no-cache directive is present in a request message, an
application SHOULD forward the request toward the origin server even
if it has a cached copy of what is being requested. This pragma
directive has the same semantics as the no-cache cache-directive (see
Section 16.2) and is

field-name = <field-name, defined here for backward compatibility with
HTTP/1.0. Clients SHOULD include both header fields when a no-cache
request is sent to a server not known to be HTTP/1.1 compliant.

Pragma directives MUST be passed through by a proxy or gateway
application, regardless of their significance to that application,
since the directives might be applicable to all recipients along the
request/response chain. It is not possible to specify a pragma for a
specific recipient; however, any pragma directive not relevant to a
recipient SHOULD be ignored by that recipient.

HTTP/1.1 caches SHOULD treat "Pragma: no-cache" as if the client had
sent "Cache-Control: no-cache". No new Pragma directives will be
defined in HTTP.

Note: because the meaning of "Pragma: no-cache" as a response-
header field is not actually specified, it does not provide a
reliable replacement for "Cache-Control: no-cache" in a response.

16.5. Vary

The "Vary" response-header field's value indicates the set of
request-header fields that fully determines, while the response is
fresh, whether a cache is permitted to use the response to reply to a
subsequent request without revalidation. For uncacheable or stale
responses, the Vary field value advises the user agent about the
criteria that were used to select the representation. A Vary field
value of "*" implies that a cache cannot determine from the request
headers of a subsequent request whether this response is the
appropriate representation. See Section 8 for use of the Vary header
field by caches.

Vary = "Vary" ":" OWS Vary-v
Vary-v = "*" / 1#field-name

An HTTP/1.1 server SHOULD include a Vary header field with any
cacheable response that is subject to server-driven negotiation.
Doing so allows a cache to properly interpret future requests on that
resource and informs the user agent about the presence of negotiation
on that resource. A server MAY include a Vary header field with a
non-cacheable response that is subject to server-driven negotiation,
since this might provide the user agent with useful information about
the dimensions over which the response varies at the time of the
response.

A Vary field value consisting of a list of field-names signals that
the representation selected for the response is based on a selection
algorithm which considers ONLY the listed request-header field values
in selecting the most appropriate representation. A cache MAY assume
that the same selection will be made for future requests with the
same values for the listed field names, for the duration of time for
which the response is fresh.

The field-names given are not limited to the set of standard request-
header fields defined by this specification. Field names are case-
insensitive.

A Vary field value of "*" signals that unspecified parameters not
limited to the request-headers (e.g., the network address of the
client), play a role in the selection of the response representation.
The "*" value MUST NOT be generated by a proxy server; it may only be
generated by an origin server.

16.6. Warning

The general-header field "Warning" is used to carry additional
information about the status or transformation of a message which
might not be reflected in the message. This information is typically
used to warn about a possible lack of semantic transparency from
caching operations or transformations applied to the entity body of
the message.

Warning headers are sent with responses using:

Warning = "Warning" ":" OWS Warning-v
Warning-v = 1#warning-value

warning-value = warn-code SP warn-agent SP warn-text
[SP warn-date]

warn-code = 3DIGIT
warn-agent = ( uri-host [ ":" port ] ) / pseudonym
; the name or pseudonym of the server adding
; the Warning header, for use in debugging
warn-text = quoted-string
warn-date = DQUOTE HTTP-date DQUOTE

A response MAY carry more than one Warning header.

The warn-text SHOULD be in a natural language and character set that
is most likely to be intelligible to the human user receiving the
response. This decision MAY be based on any available knowledge,
such as the location of the cache or user, the Accept-Language field
in a request, the Content-Language field in a response, etc. The
default language is English and the default character set is ISO-
8859-1 ([ISO-8859-1]).

If a character set other than ISO-8859-1 is used, it MUST be encoded
in the warn-text using the method described in [RFC2047].

Warning headers can in general be applied to any message, however
some specific warn-codes are specific to caches and can only be
applied to response messages. New Warning headers SHOULD be added
after any existing Warning headers. A cache MUST NOT delete any
Warning header that it received with a message. However, if a cache
successfully validates a cache entry, it SHOULD remove any Warning
headers previously attached to that entry except as specified for
specific Warning codes. It MUST then add any Warning headers
received in the validating response. In other words, Warning headers
are those that would be attached to the most recent relevant
response.

When multiple Warning headers are attached to a response, the user
agent ought to inform the user of as many of them as possible, in the
order that they appear in the response. If it is not possible to
inform the user of all of the warnings, the user agent SHOULD follow
these heuristics:

o Warnings that appear early in the response take priority over
those appearing later in the response.

o Warnings in the user's preferred character set take priority over
warnings in other character sets but with identical warn-codes and
warn-agents.

Systems that generate multiple Warning headers SHOULD order them with
this user agent behavior in mind.

Requirements for the behavior of caches with respect to Warnings are
stated in Section 3.2.

This is a list of the currently-defined warn-codes, each with a
recommended warn-text in English, and a description of its meaning.

110 Response is stale

MUST be included whenever the returned response is stale.

111 Revalidation failed

MUST be included if a cache returns a stale response because an
attempt to revalidate the response failed, due to an inability to
reach the server.

112 Disconnected operation

SHOULD be included if the cache is intentionally disconnected from
the rest of the network for a period of time.

113 Heuristic expiration

MUST be included if the cache heuristically chose a freshness
lifetime greater than 24 hours and the response's age is greater
than 24 hours.

199 Miscellaneous warning

The warning text MAY include arbitrary information to be presented
to a human user, or logged. A system receiving this warning MUST
NOT take any automated action, besides presenting the warning to
the user.

214 Transformation applied

MUST be added by an intermediate cache or proxy if it applies any
transformation changing the content-coding (as specified in the
Content-Encoding header) or media-type (as specified in the
Content-Type header) of the response, or the entity-body of the
response, unless this Warning code already appears in the
response.

299 Miscellaneous persistent warning

The warning text MAY include arbitrary information to be presented
to a human user, or logged. A system receiving this warning MUST
NOT take any automated action.

If an implementation sends a message with one or more Warning headers
whose version is HTTP/1.0 or lower, then the sender MUST include in
each warning-value a warn-date that matches the date in the response.

If an implementation receives a message with a warning-value that
includes a warn-date, and that warn-date is different from the Date
value in the response, then that warning-value MUST be deleted from
the message before storing, forwarding, or using it. (This prevents
bad consequences of naive caching of Warning header fields.) If all
of the warning-values are deleted for this reason, the Warning header
MUST be deleted as well.

17. IANA Considerations

17.1. Message Header Registration

The Message Header Registry located at <http://www.iana.org/
assignments/message-headers/message-header-index.html> should be
updated with the permanent registrations below (see [RFC3864]):

The change controller is: "IETF (iesg@ietf.org) - Internet
Engineering Task Force".

18. Security Considerations

Caching proxies provide additional potential vulnerabilities, since
the contents of the cache represent an attractive target for
malicious exploitation. Because cache contents persist after an HTTP
request is complete, an attack on the cache can reveal information
long after a user believes that the information has been removed from
the network. Therefore, cache contents should be protected as
sensitive information.

19. Acknowledgments

Much of the content and presentation of the caching design is due to
suggestions and comments from individuals including: Shel Kaphan,
Paul Leach, Koen Holtman, David Morris, and Larry Masinter.

20. References

20.1. Normative References

[ISO-8859-1]
International Organization for Standardization,
"Information technology -- 8-bit single-byte coded graphic
character sets -- Part 1: Latin alphabet No. 1", ISO/
IEC 8859-1:1998, 1998.

[Part3] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
and J. Reschke, Ed., "HTTP/1.1, part 3: Message Payload
and Content Negotiation", draft-ietf-httpbis-p3-payload-05
(work in progress), November 2008.

[Part4] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
and J. Reschke, Ed., "HTTP/1.1, part 4: Conditional
Requests", draft-ietf-httpbis-p4-conditional-05 (work [Part1], Section 4.2>

port = <port, defined in
progress), November 2008.

[Part5] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
and J. Reschke, Ed., "HTTP/1.1, part 5: Range Requests and
Partial Responses", draft-ietf-httpbis-p5-range-05 (work [Part1], Section 2.1>
pragma-directive = "no-cache" / extension-pragma
pseudonym = <pseudonym, defined in progress), November 2008.

quoted-string = <quoted-string, defined in progress),
November 2008.

[RFC2047] Moore, K., "MIME (Multipurpose Internet Mail Extensions)
Part Three: Message Header Extensions for Non-ASCII Text",
RFC 2047, November 1996.

[RFC2119] Bradner, S., "Key words for use [Part1], Section 1.2.2>

token = <token, defined in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.

20.2. Informative References

[RFC1305] Mills, D., "Network Time Protocol (Version 3)
Specification, Implementation", RFC 1305, March 1992.

[RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H.,
Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext
Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.

[RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration
Procedures for Message Header Fields", BCP 90, RFC 3864,
September 2004.

Appendix A. Compatibility with Previous Versions

A.1. Changes from RFC 2068

A case was missed [Part1], Section 1.2.2>
uri-host = <uri-host, defined in the [Part1], Section 2.1>

warn-agent = ( uri-host [ ":" port ] ) / pseudonym
warn-code = 3DIGIT
warn-date = DQUOTE HTTP-date DQUOTE
warn-text = quoted-string
warning-value = warn-code SP warn-agent SP warn-text [ SP warn-date
]

ABNF diagnostics:

; Age defined but not used
; Cache-Control model of HTTP/1.1; s-maxage
was introduced to add this missing case. (Sections 6, 16.2, 16.2.3)

Transfer-coding and message lengths all interact in ways that
required fixing exactly when chunked encoding is defined but not used (to allow for
transfer encoding that may
; Expires defined but not be self delimiting); it was important
to straighten out exactly how message lengths are computed.
(Section 7.2, see also [Part1], [Part3] and [Part5])

Proxies should be able to add Content-Length when appropriate.
(Section 7.2)
Range request responses would become very verbose if all meta-data
were always returned; by allowing the server to only send needed
headers in a 206 response, this problem can be avoided.
(Section 7.3)

The Cache-Control: max-age directive was used
; Pragma defined but not properly used
; Vary defined for
responses. (Section 16.2.3)

Warnings could be cached incorrectly, or but not updated appropriately.
(Section 3.2, 4.4, 7.2, 7.3, 16.2.3, and 16.6) used
; Warning also needed to
be a general header, as PUT or other methods may have need for it in
requests.

A.2. Changes from RFC 2616

Clarify denial of service attack avoidance requirement. (Section 12) defined but not used

Appendix B. C. Change Log (to be removed by RFC Editor before publication)

B.1.

C.1. Since RFC2616

Extracted relevant partitions from [RFC2616].

B.2.

C.2. Since draft-ietf-httpbis-p6-cache-00

Closed issues:

o <http://tools.ietf.org/wg/httpbis/trac/ticket/9>: "Trailer"
(<http://purl.org/NET/http-errata#trailer-hop>)

o <http://tools.ietf.org/wg/httpbis/trac/ticket/12>: "Invalidation
after Update or Delete"
(<http://purl.org/NET/http-errata#invalidupd>)

o <http://tools.ietf.org/wg/httpbis/trac/ticket/35>: "Normative and
Informative references"

o <http://tools.ietf.org/wg/httpbis/trac/ticket/48>: "Date reference
typo"

o <http://tools.ietf.org/wg/httpbis/trac/ticket/49>: "Connection
header text"
o <http://tools.ietf.org/wg/httpbis/trac/ticket/65>: "Informative
references"

o <http://tools.ietf.org/wg/httpbis/trac/ticket/66>: "ISO-8859-1
Reference"

o <http://tools.ietf.org/wg/httpbis/trac/ticket/86>: "Normative up-
to-date references"

o <http://tools.ietf.org/wg/httpbis/trac/ticket/87>: "typo in
13.2.2"

Other changes:

o Use names of RFC4234 core rules DQUOTE and HTAB (work in progress
on <http://tools.ietf.org/wg/httpbis/trac/ticket/36>)

B.3.

C.3. Since draft-ietf-httpbis-p6-cache-01

Closed issues:

o <http://tools.ietf.org/wg/httpbis/trac/ticket/82>: "rel_path not
used"

Other changes:

o Get rid of duplicate BNF rule names ("host" -> "uri-host") (work
in progress on <http://tools.ietf.org/wg/httpbis/trac/ticket/36>)

o Add explicit references to BNF syntax and rules imported from
other parts of the specification.

B.4.

C.4. Since draft-ietf-httpbis-p6-cache-02

Ongoing work on IANA Message Header Registration
(<http://tools.ietf.org/wg/httpbis/trac/ticket/40>):

o Reference RFC 3984, and update header registrations for headers
defined in this document.

B.5.

C.5. Since draft-ietf-httpbis-p6-cache-03

Closed issues:

o <http://tools.ietf.org/wg/httpbis/trac/ticket/106>: "Vary header
classification"

B.6.

C.6. Since draft-ietf-httpbis-p6-cache-04

Ongoing work on ABNF conversion
(<http://tools.ietf.org/wg/httpbis/trac/ticket/36>):

o Use "/" instead of "|" for alternatives.

o Introduce new ABNF rules for "bad" whitespace ("BWS"), optional
whitespace ("OWS") and required whitespace ("RWS").

o Rewrite ABNFs to spell out whitespace rules, factor out header
value format definitions.

C.7. Since draft-ietf-httpbis-p6-cache-05

This is a total rewrite of this part of the specification.

Affected issues:

o <http://tools.ietf.org/wg/httpbis/trac/ticket/54>: "Definition of
1xx Warn-Codes"

o <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/60>: "Placement
of 13.5.1 and 13.5.2"

o <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/138>: "The role
of Warning and Semantic Transparency in Caching"

o <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/139>: "Methods
and Caching"

In addition: Final work on ABNF conversion
(<http://tools.ietf.org/wg/httpbis/trac/ticket/36>):

o Add appendix containing collected and expanded ABNF, reorganize
ABNF introduction.

Index

A
age 7 6
Age header 27 17

C
cache 5
Cache Directives
max-age 32-33 18, 21
max-stale 32 19
min-fresh 32 19
must-revalidate 34 21
no-cache 29 18, 20
no-store 30 18, 21
no-transform 35 19, 22
only-if-cached 34 19
private 29 20
proxy-revalidate 35 21
public 29 20
s-maxage 31 22
Cache-Control header 27 17
cacheable 6 5

E
Expires header 37 23
explicit expiration time 7 5

F
first-hand 6
fresh 7 6
freshness lifetime 7 6

G
Grammar
Age 27 17
Age-v 27 17
Cache-Control 28 18
Cache-Control-v 28
cache-directive 28 18
cache-extension 28 18
cache-request-directive 28 18
cache-response-directive 28 20
delta-seconds 27 17
Expires 37 23
Expires-v 37 23
extension-pragma 38 24
Pragma 38 24
pragma-directive 38 24
Pragma-v 38 24
Vary 39 24
Vary-v 39 24
warn-agent 40 25
warn-code 40 25
warn-date 40 25
warn-text 40 25
Warning 40 25
Warning-v 40 25
warning-value 40 25
H
Headers
Age 27 17
Cache-Control 27 17
Expires 37 23
Pragma 38 23
Vary 38 24
Warning 39 25
heuristic expiration time 7 5

M
max-age
Cache Directive 32-33 18, 21
max-stale
Cache Directive 32 19
min-fresh
Cache Directive 32 19
must-revalidate
Cache Directive 34 21

N
no-cache
Cache Directive 29 18, 20
no-store
Cache Directive 30 18, 21
no-transform
Cache Directive 35 19, 22

O
only-if-cached
Cache Directive 34 19

P
Pragma header 38 23
private
Cache Directive 29 20
proxy-revalidate
Cache Directive 35 21
public
Cache Directive 29 20

S
s-maxage
Cache Directive 31
semantically transparent 5 22
stale 7 6

V
validator 7 6
Vary header 38 24

W
Warning header 39 25

Authors' Addresses

Roy T. Fielding (editor)
Day Software
23 Corporate Plaza DR, Suite 280
Newport Beach, CA 92660
USA

Phone: +1-949-706-5300
Fax: +1-949-706-5305
Email: fielding@gbiv.com
URI: http://roy.gbiv.com/

Jim Gettys
One Laptop per Child
21 Oak Knoll Road
Carlisle, MA 01741
USA

Email: jg@laptop.org
URI: http://www.laptop.org/

Jeffrey C. Mogul
Hewlett-Packard Company
HP Labs, Large Scale Systems Group
1501 Page Mill Road, MS 1177
Palo Alto, CA 94304
USA

Email: JeffMogul@acm.org

Henrik Frystyk Nielsen
Microsoft Corporation
1 Microsoft Way
Redmond, WA 98052
USA

Email: henrikn@microsoft.com
Larry Masinter
Adobe Systems, Incorporated
345 Park Ave
San Jose, CA 95110
USA

Email: LMM@acm.org
URI: http://larry.masinter.net/

Paul J. Leach
Microsoft Corporation
1 Microsoft Way
Redmond, WA 98052

Email: paulle@microsoft.com

Tim Berners-Lee
World Wide Web Consortium
MIT Computer Science and Artificial Intelligence Laboratory
The Stata Center, Building 32
32 Vassar Street
Cambridge, MA 02139
USA

Email: timbl@w3.org
URI: http://www.w3.org/People/Berners-Lee/

Yves Lafon (editor)
World Wide Web Consortium
W3C / ERCIM
2004, rte des Lucioles
Sophia-Antipolis, AM 06902
France

Email: ylafon@w3.org
URI: http://www.raubacapeu.net/people/yves/
Julian F. Reschke (editor)
greenbytes GmbH
Hafenweg 16
Muenster, NW 48155
Germany

Phone: +49 251 2807760
Fax: +49 251 2807761
Email: julian.reschke@greenbytes.de
URI: http://greenbytes.de/tech/webdav/

Full Copyright Statement

This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.

This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property

The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.