Hinting to Clients that a Resource Should Not be Cached

Three main headers control caching whenever a client fetches a resource over HTTP:

• Cache-Control - client cache control, defined for HTTP1.1
• Pragma - client cache control, defined for HTTP1.0
• Expires - proxy cache control, defined for both HTTP1.1 and HTTP1.0

For each of those protocols, the headers should reflect the values:

• Cache-Control → no-cache, no-store, must-revalidate
• Pragma → no-cache
• Expires → 0

Note that other values can be set, such as private that, per definition, may implicitly make the browser not cache a resource - however the meaning of private refers to the fact that the resource is intended for a single user and must not be cached by a shared cache (RFC2616 section 14.9.1) which is different from the meaning of "not caching the resource under any circumstance".