no-cache vs no-store: which Cache-Control directive stops storage
no-cache doesn't mean "don't cache". Using RFC 9111, this post compares no-cache, no-store, max-age=0 and Pragma, and shows where behavior varies across CDNs and browsers.
DevTools can list a Cache-Control: no-cache response as a cache entry. In RFC 9111, the HTTP caching spec, no-cache does not itself prohibit storage; other rules decide that (section 3). It requires origin validation before reuse. no-store is what stops storage.
no-cache: validate before every reuse
A response with an unqualified no-cache must not be reused until validation with the origin succeeds (section 5.2.2.4). To validate a complete response, the cache sends the stored ETag in If-None-Match (section 4.3.1). If it is still valid, the server can reply 304 Not Modified, which has no body (RFC 9110 section 15.4.5).
max-age=0 also makes a response stale at once, but a disconnected cache, or a client using max-stale, may still allow stale reuse (section 4.2.4). no-cache blocks unvalidated reuse even in caches configured to serve stale.
no-store: an instruction not to store
no-store forbids storing any part of the immediate request or response, in private and shared caches alike (section 5.2.2.5). Sent with no-cache, it normally keeps the response out of storage. The exception: a cache implementing must-understand SHOULD ignore no-store if it understands the status code’s caching rules (section 5.2.2.3). The spec also says no-store is not a reliable or sufficient privacy measure; it can’t stop caches that ignore it, or eavesdropping.
Where behavior varies across CDNs and browsers
- With a field list such as
no-cache="Set-Cookie", the spec allows unvalidated reuse only if those fields are omitted. This form isn’t widely implemented; many caches treat it as plain no-cache (section 5.2.2.4). A Set-Cookie header alone doesn’t stop an otherwise cacheable response from being cached (section 7.3). - Per Cloudflare’s docs, with Origin Cache Control on, no-cache responses are cached and always revalidated; with it off, they aren’t cached. Free, Pro and Business plans have it on, with no way to turn it off.
- The back/forward cache (bfcache) is not the HTTP cache. web.dev says browsers have historically excluded no-store pages from it, and Chrome is working to change this. Restores ignore no-cache and max-age=0, so web.dev recommends the pageshow event for fresh content. This varies by browser and version.
Pragma: no-cacheis a deprecated HTTP/1.0 request header with no defined meaning in responses (section 5.4).
Non-sensitive HTML or API responses that only need revalidation can use no-cache with an ETag. Responses that must not be stored get no-store, plus protection such as HTTPS. Redirect caching is covered in 301, 302, 307 or 308?.