Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 155 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

All pages (that I tested) on Stack Overflow have this header:

Cache-Control: public, max-age=60

The problematic part is the public keyword which should be private instead. According to RFC 2616, Section 14.9.1:

public

Indicates that the response MAY be cached by any cache, even if it would normally be non-cacheable or cacheable only within a non- shared cache. (See also Authorization, section 14.8, for additional details.)

private

Indicates that all or part of the response message is intended for a single user and MUST NOT be cached by a shared cache. This allows an origin server to state that the specified parts of the response are intended for only one user and are not a valid response for requests by other users. A private (non-shared) cache MAY cache the response.

In short the public keyword is allowing well-behaving proxies to cache the content sent to a logged-in user and display it to other people.

This is most definitely what is causing issues like Co-workers logged in as me when viewing question I asked and others (I've seen at least another similar report, but I can't find it anymore).

EDIT: there was an error in my original post in which I implied that public was fine for unregistered users. This is not true since the proxy would be instructed to send the unregistered page (no user name, etc) to - possibly - registered users. It should be private in all cases.

share|improve this question
    
But all responses also carry a Vary: * header, thus instructing proxies not to send cached versions if user Cookies: or even just the User-Agent: mismatch. – mario Jan 3 '11 at 15:49

Mario is correct - we also use the Vary: * header which according to http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html#sec13.6

A Vary header field-value of * always fails to match and subsequent requests on that resource can only be properly interpreted by the origin server.

http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.44

A Vary field value of * signals that unspecified parameters not limited to the request-headers (e.g., the network address of the client), play a role in the selection of the response representation. The * value MUST NOT be generated by a proxy server; it may only be generated by an origin server.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .