Subject: Re: I-D Action: draft-ietf-httpbis-cache-08.txt

From: Ken Murchison <[email-masked]>
Date: Sat, 13 Jun 2020 09:32:09 -0400

All,

I'm trying to verify my understanding of must-revalidate vs unqualified 
no-cache in responses per the text in Sections 5.2.2.1 and 5.2.2.3 
respectively.  Other than the point regarding the Authorization header 
field and must-revalidate, is the difference that unqualified no-cache 
requires validation for every request and must-revalidate only requires 
validation after the response has become stale?

--
Kenneth Murchison
Senior Software Developer
Fastmail US LLC

---

From: Amos Jeffries <[email-masked]>
Date: Sun, 14 Jun 2020 13:27:53 +1200

> validation after the response has become stale?

The specification difference is exactly that yes.

In practice implementations (particularly older RFC2616 based ones) may
treat "no-cache" as if it were "no-store" and "must-revalidate" as if it
were unqualified "no-cache".

Amos

---

From: Ken Murchison <[email-masked]>
Date: Sun, 14 Jun 2020 12:37:24 -0400

> The specification difference is exactly that yes.

Thanks Amos.

> were unqualified "no-cache".

So, given the possible ambiguity here, would a best practice for 
cacheable resources that should always be validated be for the origin 
server to return maxage: 0 or Expires in the past?

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 23 Jun 2020 16:46:13 +1000

> On 14 Jun 2020, at 11:27 am, Amos Jeffries <[email-masked]> wrote:
> 

That's not what I'm seeing in the tests:
  https://cache-tests.fyi/?id=cc-resp-no-cache-revalidate&id=cc-resp-no-cache-revalidate-fresh&id=cc-resp-must-revalidate-fresh#

--
Mark Nottingham   https://www.mnot.net/