What does cache validation (no-cache for cache-control header) do in http protocol?

Question

I'm trying to understand how the cache-control http header works.

The cache-control header can have the no-cache value. I have checked the definition in w3c and it said:

If the no-cache directive does not specify a field-name, then a cache MUST NOT use the response to satisfy a subsequent request without successful revalidation with the origin server.

It tells no-cache value will trigger validation for every request.

What I want to know is, what is cache validation and what it does in the http protocol?

thanks for your help guys. now i understand validation means check if cache contain latest content from server.

my further question would be what issues no-cache will fix. please provide some scenario, like after applied no-cache in http header, what security issue will be fixed.

thanks guys

Answer 1

The no-cache directive is not intended for a security purpose. Security gets covered in rules that define which data/resources a cdn/proxy server is not permitted to cache. So, if security is required, the no-store directive should be used by the client/server. Look under :

• paragraph 2 under section 13.4 on https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
• https://www.rfc-editor.org/rfc/rfc7234#section-3

The no-cache directive is used by the client when it is ready to accept a resource from a cache, provided there is a confirmation from the server that the cached resource is up to date (fresh). The proxy/cdn can use two methods to re-validate the resource's freshness :

1. If client sent an ETAG value, proxy/cdn can forward it to the server under an If-None-Match header. If server responds with '304 Not Modified', then the cached resource is fresh to serve.

2. Using an If-Modified-Since header with a date value that was received the last time the resource was downloaded from the server (was to be found under the Last-Modified header in server's last response).