All pages (that I tested) on Stack Overflow have this header:

Cache-Control: public, max-age=60

The problematic part is the public keyword which should be private instead. According to RFC 2616, Section 14.9.1:


Indicates that the response MAY be cached by any cache, even if it would normally be non-cacheable or cacheable only within a non- shared cache. (See also Authorization, section 14.8, for additional details.)


Indicates that all or part of the response message is intended for a single user and MUST NOT be cached by a shared cache. This allows an origin server to state that the specified parts of the response are intended for only one user and are not a valid response for requests by other users. A private (non-shared) cache MAY cache the response.

In short the public keyword is allowing well-behaving proxies to cache the content sent to a logged-in user and display it to other people.

This is most definitely what is causing issues like Co-workers logged in as me when viewing question I asked and others (I've seen at least another similar report, but I can't find it anymore).

EDIT: there was an error in my original post in which I implied that public was fine for unregistered users. This is not true since the proxy would be instructed to send the unregistered page (no user name, etc) to - possibly - registered users. It should be private in all cases.

  • But all responses also carry a Vary: * header, thus instructing proxies not to send cached versions if user Cookies: or even just the User-Agent: mismatch.
    – mario
    Commented Jan 3, 2011 at 15:49

1 Answer 1


Mario is correct - we also use the Vary: * header which according to http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html#sec13.6

A Vary header field-value of * always fails to match and subsequent requests on that resource can only be properly interpreted by the origin server.


A Vary field value of * signals that unspecified parameters not limited to the request-headers (e.g., the network address of the client), play a role in the selection of the response representation. The * value MUST NOT be generated by a proxy server; it may only be generated by an origin server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .