Cache-Control builder
Pick the directives for your content and get the header, Spring, Express and nginx code, with contradictions flagged.
Telling browsers and CDNs how long to keep a response
The Cache-Control response header is the main lever for web performance on the server side. A long lifetime on static files makes repeat visits instant; a missing or wrong header makes users download the same bundle every time, or worse, see an old page after a deployment. The directives are easy to misread (no-cache does not mean "do not cache") and easy to combine into contradictions.
Choose a preset for the common cases or set the directives yourself: public or private, max-age, s-maxage, no-cache, no-store, must-revalidate, immutable, stale-while-revalidate and stale-if-error. The builder writes the header and the same value as Spring's CacheControl builder, an Express call and an nginx directive, and warns about directives that cancel each other out.
A sensible strategy
- Fingerprinted assets (JS, CSS, images with a hash in the name):
public, max-age=31536000, immutable. - HTML pages:
no-cachewith an ETag, so they are revalidated cheaply. - API responses that are the same for everyone: a short
max-ageand a longers-maxagefor the CDN. - Per-user data:
private, andno-storefor anything sensitive.
Caching and revalidation also need validators: send an ETag or Last-Modified header so the browser can ask "has it changed?" and get a tiny 304 response. Your CDN may add its own rules, so check its documentation. Everything is generated locally in your browser.
Frequently asked questions
What is the difference between no-cache and no-store?
no-store forbids storing the response at all. no-cache allows storing it but requires revalidation with the server before every reuse. For sensitive data use no-store; for HTML that must always be fresh use no-cache.
What does immutable mean?
It tells the browser the file will never change at that URL, so it should not even revalidate on reload. Use it only for fingerprinted files such as app.3f9a2c.js, whose URL changes whenever the content does.
What is s-maxage?
The lifetime for shared caches such as CDNs and proxies, overriding max-age for them. It lets a CDN keep a response for five minutes while browsers keep it for one.
What is stale-while-revalidate?
It lets a cache serve a stale copy immediately while fetching a fresh one in the background, hiding latency. Support depends on the browser or CDN.