A proxy cache stores an eligible response and reuses it for later requests. Done well, this reduces origin work and network latency. Done badly, it can serve stale information or one user's private response to another.
Freshness and revalidation
Cache-Control directives describe whether a response may be stored and for how long. Validators such as ETag allow a cache to ask whether its copy is still current.
The cache key matters
A shared cache must vary on every request property that changes the representation. Missing language, encoding or authorization differences can produce incorrect content.
Protect private responses
For personalized responses, use Cache-Control: private to exclude shared caches, or no-store when storage itself must be prevented. no-cache permits storage but requires validation before reuse. A cookie or Set-Cookie header alone is not a universal shared-cache prohibition. Responses to requests with Authorization need an explicit directive permitting shared caching under HTTP rules; a custom cache key alone is insufficient. Test logout and account switching.
Measure before expanding
Track hit ratio, age, origin load and purge behavior. Cache stable public assets first; add dynamic content only with documented invalidation.
Purge is part of publishing
Teams need a tested way to invalidate an incorrect or sensitive response quickly. Versioned asset filenames reduce purge needs, while editorial pages may require targeted URL invalidation.
Test freshness as well as speed
Inspect Age, Cache-Control, ETag and a safe cache-status header across a miss, hit, revalidation and purge. Change the resource and confirm that visitors receive the intended version. Serving stale content can be intentional when the applicable policy permits it, such as a configured stale-while-revalidate or stale-if-error window. Serving it outside that policy, or despite a directive requiring validation, is a correctness failure.
Keep a tested invalidation path for urgent editorial and security changes. Versioned filenames reduce static-asset purges, while documents may need targeted invalidation. Measure origin load and latency before expanding rules, then monitor hit ratio alongside error and staleness reports.
Test requests with and without cookies, authorization and language headers. Serious cache failures often appear only when two users should receive different representations of the same URL.