What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

All pages (that I tested) on Stack Overflow have this header:

Cache-Control: public, max-age=60

The problematic part is the public keyword which should be private instead. According to RFC 2616, Section 14.9.1:

public

Indicates that the response MAY be cached by any cache, even if it would normally be non-cacheable or cacheable only within a non- shared cache. (See also Authorization, section 14.8, for additional details.)

private

Indicates that all or part of the response message is intended for a single user and MUST NOT be cached by a shared cache. This allows an origin server to state that the specified parts of the response are intended for only one user and are not a valid response for requests by other users. A private (non-shared) cache MAY cache the response.

In short the public keyword is allowing well-behaving proxies to cache the content sent to a logged-in user and display it to other people.

This is most definitely what is causing issues like Co-workers logged in as me when viewing question I asked and others (I've seen at least another similar report, but I can't find it anymore).

EDIT: there was an error in my original post in which I implied that public was fine for unregistered users. This is not true since the proxy would be instructed to send the unregistered page (no user name, etc) to - possibly - registered users. It should be private in all cases.

share|improve this question
    
But all responses also carry a Vary: * header, thus instructing proxies not to send cached versions if user Cookies: or even just the User-Agent: mismatch. –  mario Jan 3 '11 at 15:49

1 Answer 1

Mario is correct - we also use the Vary: * header which according to http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html#sec13.6

A Vary header field-value of * always fails to match and subsequent requests on that resource can only be properly interpreted by the origin server.

http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.44

A Vary field value of * signals that unspecified parameters not limited to the request-headers (e.g., the network address of the client), play a role in the selection of the response representation. The * value MUST NOT be generated by a proxy server; it may only be generated by an origin server.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .