source: draft-ietf-httpbis/01/draft-ietf-httpbis-p6-cache-01.txt @ 1391

Last change on this file since 1391 was 166, checked in by fielding@…, 12 years ago

generated draft 01

  • Property svn:eol-style set to native
File size: 110.5 KB
Line 
1
2
3
4Network Working Group                                   R. Fielding, Ed.
5Internet-Draft                                              Day Software
6Obsoletes: 2616 (if approved)                                  J. Gettys
7Intended status: Standards Track                    One Laptop per Child
8Expires: July 15, 2008                                          J. Mogul
9                                                                      HP
10                                                              H. Frystyk
11                                                               Microsoft
12                                                             L. Masinter
13                                                           Adobe Systems
14                                                                P. Leach
15                                                               Microsoft
16                                                          T. Berners-Lee
17                                                                 W3C/MIT
18                                                           Y. Lafon, Ed.
19                                                                     W3C
20                                                         J. Reschke, Ed.
21                                                              greenbytes
22                                                        January 12, 2008
23
24
25                       HTTP/1.1, part 6: Caching
26                     draft-ietf-httpbis-p6-cache-01
27
28Status of this Memo
29
30   By submitting this Internet-Draft, each author represents that any
31   applicable patent or other IPR claims of which he or she is aware
32   have been or will be disclosed, and any of which he or she becomes
33   aware will be disclosed, in accordance with Section 6 of BCP 79.
34
35   Internet-Drafts are working documents of the Internet Engineering
36   Task Force (IETF), its areas, and its working groups.  Note that
37   other groups may also distribute working documents as Internet-
38   Drafts.
39
40   Internet-Drafts are draft documents valid for a maximum of six months
41   and may be updated, replaced, or obsoleted by other documents at any
42   time.  It is inappropriate to use Internet-Drafts as reference
43   material or to cite them other than as "work in progress."
44
45   The list of current Internet-Drafts can be accessed at
46   http://www.ietf.org/ietf/1id-abstracts.txt.
47
48   The list of Internet-Draft Shadow Directories can be accessed at
49   http://www.ietf.org/shadow.html.
50
51   This Internet-Draft will expire on July 15, 2008.
52
53
54
55Fielding, et al.          Expires July 15, 2008                 [Page 1]
56
57Internet-Draft              HTTP/1.1, Part 6                January 2008
58
59
60Copyright Notice
61
62   Copyright (C) The IETF Trust (2008).
63
64Abstract
65
66   The Hypertext Transfer Protocol (HTTP) is an application-level
67   protocol for distributed, collaborative, hypermedia information
68   systems.  HTTP has been in use by the World Wide Web global
69   information initiative since 1990.  This document is Part 6 of the
70   seven-part specification that defines the protocol referred to as
71   "HTTP/1.1" and, taken together, obsoletes RFC 2616.  Part 6 defines
72   requirements on HTTP caches and the associated header fields that
73   control cache behavior or indicate cacheable response messages.
74
75Editorial Note (To be removed by RFC Editor)
76
77   Discussion of this draft should take place on the HTTPBIS working
78   group mailing list (ietf-http-wg@w3.org).  The current issues list is
79   at <http://www.tools.ietf.org/wg/httpbis/trac/report/11> and related
80   documents (including fancy diffs) can be found at
81   <http://www.tools.ietf.org/wg/httpbis/>.
82
83   This draft incorporates those issue resolutions that were either
84   collected in the original RFC2616 errata list
85   (<http://purl.org/NET/http-errata>), or which were agreed upon on the
86   mailing list between October 2006 and November 2007 (as published in
87   "draft-lafon-rfc2616bis-03").
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111Fielding, et al.          Expires July 15, 2008                 [Page 2]
112
113Internet-Draft              HTTP/1.1, Part 6                January 2008
114
115
116Table of Contents
117
118   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  5
119     1.1.  Purpose  . . . . . . . . . . . . . . . . . . . . . . . . .  5
120     1.2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . .  6
121     1.3.  Requirements . . . . . . . . . . . . . . . . . . . . . . .  7
122   2.  Overview . . . . . . . . . . . . . . . . . . . . . . . . . . .  8
123     2.1.  Cache Correctness  . . . . . . . . . . . . . . . . . . . .  8
124     2.2.  Warnings . . . . . . . . . . . . . . . . . . . . . . . . .  8
125     2.3.  Cache-control Mechanisms . . . . . . . . . . . . . . . . . 10
126     2.4.  Explicit User Agent Warnings . . . . . . . . . . . . . . . 10
127     2.5.  Exceptions to the Rules and Warnings . . . . . . . . . . . 11
128     2.6.  Client-controlled Behavior . . . . . . . . . . . . . . . . 11
129   3.  Expiration Model . . . . . . . . . . . . . . . . . . . . . . . 11
130     3.1.  Server-Specified Expiration  . . . . . . . . . . . . . . . 11
131     3.2.  Heuristic Expiration . . . . . . . . . . . . . . . . . . . 12
132     3.3.  Age Calculations . . . . . . . . . . . . . . . . . . . . . 13
133     3.4.  Expiration Calculations  . . . . . . . . . . . . . . . . . 15
134     3.5.  Disambiguating Expiration Values . . . . . . . . . . . . . 16
135     3.6.  Disambiguating Multiple Responses  . . . . . . . . . . . . 16
136   4.  Validation Model . . . . . . . . . . . . . . . . . . . . . . . 17
137     4.1.  Last-Modified Dates  . . . . . . . . . . . . . . . . . . . 18
138     4.2.  Entity Tag Cache Validators  . . . . . . . . . . . . . . . 18
139     4.3.  Non-validating Conditionals  . . . . . . . . . . . . . . . 18
140   5.  Response Cacheability  . . . . . . . . . . . . . . . . . . . . 18
141   6.  Constructing Responses From Caches . . . . . . . . . . . . . . 19
142     6.1.  End-to-end and Hop-by-hop Headers  . . . . . . . . . . . . 19
143     6.2.  Non-modifiable Headers . . . . . . . . . . . . . . . . . . 20
144     6.3.  Combining Headers  . . . . . . . . . . . . . . . . . . . . 21
145   7.  Caching Negotiated Responses . . . . . . . . . . . . . . . . . 22
146   8.  Shared and Non-Shared Caches . . . . . . . . . . . . . . . . . 24
147   9.  Errors or Incomplete Response Cache Behavior . . . . . . . . . 24
148   10. Side Effects of GET and HEAD . . . . . . . . . . . . . . . . . 24
149   11. Invalidation After Updates or Deletions  . . . . . . . . . . . 25
150   12. Write-Through Mandatory  . . . . . . . . . . . . . . . . . . . 26
151   13. Cache Replacement  . . . . . . . . . . . . . . . . . . . . . . 26
152   14. History Lists  . . . . . . . . . . . . . . . . . . . . . . . . 26
153   15. Header Field Definitions . . . . . . . . . . . . . . . . . . . 27
154     15.1. Age  . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
155     15.2. Cache-Control  . . . . . . . . . . . . . . . . . . . . . . 28
156       15.2.1.  What is Cacheable . . . . . . . . . . . . . . . . . . 30
157       15.2.2.  What May be Stored by Caches  . . . . . . . . . . . . 31
158       15.2.3.  Modifications of the Basic Expiration Mechanism . . . 31
159       15.2.4.  Cache Revalidation and Reload Controls  . . . . . . . 33
160       15.2.5.  No-Transform Directive  . . . . . . . . . . . . . . . 36
161       15.2.6.  Cache Control Extensions  . . . . . . . . . . . . . . 37
162     15.3. Expires  . . . . . . . . . . . . . . . . . . . . . . . . . 37
163     15.4. Pragma . . . . . . . . . . . . . . . . . . . . . . . . . . 38
164
165
166
167Fielding, et al.          Expires July 15, 2008                 [Page 3]
168
169Internet-Draft              HTTP/1.1, Part 6                January 2008
170
171
172     15.5. Vary . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
173     15.6. Warning  . . . . . . . . . . . . . . . . . . . . . . . . . 40
174   16. IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 43
175   17. Security Considerations  . . . . . . . . . . . . . . . . . . . 43
176   18. Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 43
177   19. References . . . . . . . . . . . . . . . . . . . . . . . . . . 43
178     19.1. Normative References . . . . . . . . . . . . . . . . . . . 43
179     19.2. Informative References . . . . . . . . . . . . . . . . . . 44
180   Appendix A.  Compatibility with Previous Versions  . . . . . . . . 44
181     A.1.  Changes from RFC 2068  . . . . . . . . . . . . . . . . . . 44
182     A.2.  Changes from RFC 2616  . . . . . . . . . . . . . . . . . . 45
183   Appendix B.  Change Log (to be removed by RFC Editor before
184                publication)  . . . . . . . . . . . . . . . . . . . . 45
185     B.1.  Since RFC2616  . . . . . . . . . . . . . . . . . . . . . . 45
186     B.2.  Since draft-ietf-httpbis-p6-cache-00 . . . . . . . . . . . 45
187   Index  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
188   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 48
189   Intellectual Property and Copyright Statements . . . . . . . . . . 52
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223Fielding, et al.          Expires July 15, 2008                 [Page 4]
224
225Internet-Draft              HTTP/1.1, Part 6                January 2008
226
227
2281.  Introduction
229
230   HTTP is typically used for distributed information systems, where
231   performance can be improved by the use of response caches, and
232   includes a number of elements intended to make caching work as well
233   as possible.  Because these elements interact with each other, it is
234   useful to describe the caching design of HTTP separately.  This
235   document defines aspects of HTTP/1.1 related to caching and reusing
236   response messages.
237
2381.1.  Purpose
239
240   An HTTP cache is a local store of response messages and the subsystem
241   that controls its message storage, retrieval, and deletion.  A cache
242   stores cacheable responses in order to reduce the response time and
243   network bandwidth consumption on future, equivalent requests.  Any
244   client or server may include a cache, though a cache cannot be used
245   by a server that is acting as a tunnel.
246
247   Caching would be useless if it did not significantly improve
248   performance.  The goal of caching in HTTP/1.1 is to eliminate the
249   need to send requests in many cases, and to eliminate the need to
250   send full responses in many other cases.  The former reduces the
251   number of network round-trips required for many operations; we use an
252   "expiration" mechanism for this purpose (see Section 3).  The latter
253   reduces network bandwidth requirements; we use a "validation"
254   mechanism for this purpose (see Section 4).
255
256   A cache behaves in a "semantically transparent" manner, with respect
257   to a particular response, when its use affects neither the requesting
258   client nor the origin server, except to improve performance.  When a
259   cache is semantically transparent, the client receives exactly the
260   same response (except for hop-by-hop headers) that it would have
261   received had its request been handled directly by the origin server.
262
263   In an ideal world, all interactions with an HTTP cache would be
264   semantically transparent.  However, for some resources, semantic
265   transparency is not always necessary and can be effectively traded
266   for the sake of bandwidth scaling, disconnected operation, and high
267   availability.  HTTP/1.1 allows origin servers, caches, and clients to
268   explicitly reduce transparency when necessary.  However, because non-
269   transparent operation may confuse non-expert users and might be
270   incompatible with certain server applications (such as those for
271   ordering merchandise), the protocol requires that transparency be
272   relaxed
273
274   o  only by an explicit protocol-level request when relaxed by client
275      or origin server
276
277
278
279Fielding, et al.          Expires July 15, 2008                 [Page 5]
280
281Internet-Draft              HTTP/1.1, Part 6                January 2008
282
283
284   o  only with an explicit warning to the end user when relaxed by
285      cache or client
286
287   Therefore, HTTP/1.1 provides these important elements:
288
289   1.  Protocol features that provide full semantic transparency when
290       this is required by all parties.
291
292   2.  Protocol features that allow an origin server or user agent to
293       explicitly request and control non-transparent operation.
294
295   3.  Protocol features that allow a cache to attach warnings to
296       responses that do not preserve the requested approximation of
297       semantic transparency.
298
299   A basic principle is that it must be possible for the clients to
300   detect any potential relaxation of semantic transparency.
301
302      Note: The server, cache, or client implementor might be faced with
303      design decisions not explicitly discussed in this specification.
304      If a decision might affect semantic transparency, the implementor
305      ought to err on the side of maintaining transparency unless a
306      careful and complete analysis shows significant benefits in
307      breaking transparency.
308
3091.2.  Terminology
310
311   This specification uses a number of terms to refer to the roles
312   played by participants in, and objects of, HTTP caching.
313
314   cacheable
315
316      A response is cacheable if a cache is allowed to store a copy of
317      the response message for use in answering subsequent requests.
318      Even if a resource is cacheable, there may be additional
319      constraints on whether a cache can use the cached copy for a
320      particular request.
321
322   first-hand
323
324      A response is first-hand if it comes directly and without
325      unnecessary delay from the origin server, perhaps via one or more
326      proxies.  A response is also first-hand if its validity has just
327      been checked directly with the origin server.
328
329   explicit expiration time
330
331
332
333
334
335Fielding, et al.          Expires July 15, 2008                 [Page 6]
336
337Internet-Draft              HTTP/1.1, Part 6                January 2008
338
339
340      The time at which the origin server intends that an entity should
341      no longer be returned by a cache without further validation.
342
343   heuristic expiration time
344
345      An expiration time assigned by a cache when no explicit expiration
346      time is available.
347
348   age
349
350      The age of a response is the time since it was sent by, or
351      successfully validated with, the origin server.
352
353   freshness lifetime
354
355      The length of time between the generation of a response and its
356      expiration time.
357
358   fresh
359
360      A response is fresh if its age has not yet exceeded its freshness
361      lifetime.
362
363   stale
364
365      A response is stale if its age has passed its freshness lifetime.
366
367   validator
368
369      A protocol element (e.g., an entity tag or a Last-Modified time)
370      that is used to find out whether a cache entry is an equivalent
371      copy of an entity.
372
3731.3.  Requirements
374
375   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
376   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
377   document are to be interpreted as described in [RFC2119].
378
379   An implementation is not compliant if it fails to satisfy one or more
380   of the MUST or REQUIRED level requirements for the protocols it
381   implements.  An implementation that satisfies all the MUST or
382   REQUIRED level and all the SHOULD level requirements for its
383   protocols is said to be "unconditionally compliant"; one that
384   satisfies all the MUST level requirements but not all the SHOULD
385   level requirements for its protocols is said to be "conditionally
386   compliant."
387
388
389
390
391Fielding, et al.          Expires July 15, 2008                 [Page 7]
392
393Internet-Draft              HTTP/1.1, Part 6                January 2008
394
395
3962.  Overview
397
3982.1.  Cache Correctness
399
400   A correct cache MUST respond to a request with the most up-to-date
401   response held by the cache that is appropriate to the request (see
402   Sections 3.5, 3.6, and 13) which meets one of the following
403   conditions:
404
405   1.  It has been checked for equivalence with what the origin server
406       would have returned by revalidating the response with the origin
407       server (Section 4);
408
409   2.  It is "fresh enough" (see Section 3).  In the default case, this
410       means it meets the least restrictive freshness requirement of the
411       client, origin server, and cache (see Section 15.2); if the
412       origin server so specifies, it is the freshness requirement of
413       the origin server alone.  If a stored response is not "fresh
414       enough" by the most restrictive freshness requirement of both the
415       client and the origin server, in carefully considered
416       circumstances the cache MAY still return the response with the
417       appropriate Warning header (see Sections 2.5 and 15.6), unless
418       such a response is prohibited (e.g., by a "no-store" cache-
419       directive, or by a "no-cache" cache-request-directive; see
420       Section 15.2).
421
422   3.  It is an appropriate 304 (Not Modified), 305 (Use Proxy), or
423       error (4xx or 5xx) response message.
424
425   If the cache can not communicate with the origin server, then a
426   correct cache SHOULD respond as above if the response can be
427   correctly served from the cache; if not it MUST return an error or
428   warning indicating that there was a communication failure.
429
430   If a cache receives a response (either an entire response, or a 304
431   (Not Modified) response) that it would normally forward to the
432   requesting client, and the received response is no longer fresh, the
433   cache SHOULD forward it to the requesting client without adding a new
434   Warning (but without removing any existing Warning headers).  A cache
435   SHOULD NOT attempt to revalidate a response simply because that
436   response became stale in transit; this might lead to an infinite
437   loop.  A user agent that receives a stale response without a Warning
438   MAY display a warning indication to the user.
439
4402.2.  Warnings
441
442   Whenever a cache returns a response that is neither first-hand nor
443   "fresh enough" (in the sense of condition 2 in Section 2.1), it MUST
444
445
446
447Fielding, et al.          Expires July 15, 2008                 [Page 8]
448
449Internet-Draft              HTTP/1.1, Part 6                January 2008
450
451
452   attach a warning to that effect, using a Warning general-header.  The
453   Warning header and the currently defined warnings are described in
454   Section 15.6.  The warning allows clients to take appropriate action.
455
456   Warnings MAY be used for other purposes, both cache-related and
457   otherwise.  The use of a warning, rather than an error status code,
458   distinguish these responses from true failures.
459
460   Warnings are assigned three digit warn-codes.  The first digit
461   indicates whether the Warning MUST or MUST NOT be deleted from a
462   stored cache entry after a successful revalidation:
463
464   1xx  Warnings that describe the freshness or revalidation status of
465      the response, and so MUST be deleted after a successful
466      revalidation. 1xx warn-codes MAY be generated by a cache only when
467      validating a cached entry.  It MUST NOT be generated by clients.
468
469   2xx  Warnings that describe some aspect of the entity body or entity
470      headers that is not rectified by a revalidation (for example, a
471      lossy compression of the entity bodies) and which MUST NOT be
472      deleted after a successful revalidation.
473
474   See Section 15.6 for the definitions of the codes themselves.
475
476   HTTP/1.0 caches will cache all Warnings in responses, without
477   deleting the ones in the first category.  Warnings in responses that
478   are passed to HTTP/1.0 caches carry an extra warning-date field,
479   which prevents a future HTTP/1.1 recipient from believing an
480   erroneously cached Warning.
481
482   Warnings also carry a warning text.  The text MAY be in any
483   appropriate natural language (perhaps based on the client's Accept
484   headers), and include an OPTIONAL indication of what character set is
485   used.
486
487   Multiple warnings MAY be attached to a response (either by the origin
488   server or by a cache), including multiple warnings with the same code
489   number.  For example, a server might provide the same warning with
490   texts in both English and Basque.
491
492   When multiple warnings are attached to a response, it might not be
493   practical or reasonable to display all of them to the user.  This
494   version of HTTP does not specify strict priority rules for deciding
495   which warnings to display and in what order, but does suggest some
496   heuristics.
497
498
499
500
501
502
503Fielding, et al.          Expires July 15, 2008                 [Page 9]
504
505Internet-Draft              HTTP/1.1, Part 6                January 2008
506
507
5082.3.  Cache-control Mechanisms
509
510   The basic cache mechanisms in HTTP/1.1 (server-specified expiration
511   times and validators) are implicit directives to caches.  In some
512   cases, a server or client might need to provide explicit directives
513   to the HTTP caches.  We use the Cache-Control header for this
514   purpose.
515
516   The Cache-Control header allows a client or server to transmit a
517   variety of directives in either requests or responses.  These
518   directives typically override the default caching algorithms.  As a
519   general rule, if there is any apparent conflict between header
520   values, the most restrictive interpretation is applied (that is, the
521   one that is most likely to preserve semantic transparency).  However,
522   in some cases, cache-control directives are explicitly specified as
523   weakening the approximation of semantic transparency (for example,
524   "max-stale" or "public").
525
526   The cache-control directives are described in detail in Section 15.2.
527
5282.4.  Explicit User Agent Warnings
529
530   Many user agents make it possible for users to override the basic
531   caching mechanisms.  For example, the user agent might allow the user
532   to specify that cached entities (even explicitly stale ones) are
533   never validated.  Or the user agent might habitually add "Cache-
534   Control: max-stale=3600" to every request.  The user agent SHOULD NOT
535   default to either non-transparent behavior, or behavior that results
536   in abnormally ineffective caching, but MAY be explicitly configured
537   to do so by an explicit action of the user.
538
539   If the user has overridden the basic caching mechanisms, the user
540   agent SHOULD explicitly indicate to the user whenever this results in
541   the display of information that might not meet the server's
542   transparency requirements (in particular, if the displayed entity is
543   known to be stale).  Since the protocol normally allows the user
544   agent to determine if responses are stale or not, this indication
545   need only be displayed when this actually happens.  The indication
546   need not be a dialog box; it could be an icon (for example, a picture
547   of a rotting fish) or some other indicator.
548
549   If the user has overridden the caching mechanisms in a way that would
550   abnormally reduce the effectiveness of caches, the user agent SHOULD
551   continually indicate this state to the user (for example, by a
552   display of a picture of currency in flames) so that the user does not
553   inadvertently consume excess resources or suffer from excessive
554   latency.
555
556
557
558
559Fielding, et al.          Expires July 15, 2008                [Page 10]
560
561Internet-Draft              HTTP/1.1, Part 6                January 2008
562
563
5642.5.  Exceptions to the Rules and Warnings
565
566   In some cases, the operator of a cache MAY choose to configure it to
567   return stale responses even when not requested by clients.  This
568   decision ought not be made lightly, but may be necessary for reasons
569   of availability or performance, especially when the cache is poorly
570   connected to the origin server.  Whenever a cache returns a stale
571   response, it MUST mark it as such (using a Warning header) enabling
572   the client software to alert the user that there might be a potential
573   problem.
574
575   It also allows the user agent to take steps to obtain a first-hand or
576   fresh response.  For this reason, a cache SHOULD NOT return a stale
577   response if the client explicitly requests a first-hand or fresh one,
578   unless it is impossible to comply for technical or policy reasons.
579
5802.6.  Client-controlled Behavior
581
582   While the origin server (and to a lesser extent, intermediate caches,
583   by their contribution to the age of a response) are the primary
584   source of expiration information, in some cases the client might need
585   to control a cache's decision about whether to return a cached
586   response without validating it.  Clients do this using several
587   directives of the Cache-Control header.
588
589   A client's request MAY specify the maximum age it is willing to
590   accept of an unvalidated response; specifying a value of zero forces
591   the cache(s) to revalidate all responses.  A client MAY also specify
592   the minimum time remaining before a response expires.  Both of these
593   options increase constraints on the behavior of caches, and so cannot
594   further relax the cache's approximation of semantic transparency.
595
596   A client MAY also specify that it will accept stale responses, up to
597   some maximum amount of staleness.  This loosens the constraints on
598   the caches, and so might violate the origin server's specified
599   constraints on semantic transparency, but might be necessary to
600   support disconnected operation, or high availability in the face of
601   poor connectivity.
602
603
6043.  Expiration Model
605
6063.1.  Server-Specified Expiration
607
608   HTTP caching works best when caches can entirely avoid making
609   requests to the origin server.  The primary mechanism for avoiding
610   requests is for an origin server to provide an explicit expiration
611   time in the future, indicating that a response MAY be used to satisfy
612
613
614
615Fielding, et al.          Expires July 15, 2008                [Page 11]
616
617Internet-Draft              HTTP/1.1, Part 6                January 2008
618
619
620   subsequent requests.  In other words, a cache can return a fresh
621   response without first contacting the server.
622
623   Our expectation is that servers will assign future explicit
624   expiration times to responses in the belief that the entity is not
625   likely to change, in a semantically significant way, before the
626   expiration time is reached.  This normally preserves semantic
627   transparency, as long as the server's expiration times are carefully
628   chosen.
629
630   The expiration mechanism applies only to responses taken from a cache
631   and not to first-hand responses forwarded immediately to the
632   requesting client.
633
634   If an origin server wishes to force a semantically transparent cache
635   to validate every request, it MAY assign an explicit expiration time
636   in the past.  This means that the response is always stale, and so
637   the cache SHOULD validate it before using it for subsequent requests.
638   See Section 15.2.4 for a more restrictive way to force revalidation.
639
640   If an origin server wishes to force any HTTP/1.1 cache, no matter how
641   it is configured, to validate every request, it SHOULD use the "must-
642   revalidate" cache-control directive (see Section 15.2).
643
644   Servers specify explicit expiration times using either the Expires
645   header, or the max-age directive of the Cache-Control header.
646
647   An expiration time cannot be used to force a user agent to refresh
648   its display or reload a resource; its semantics apply only to caching
649   mechanisms, and such mechanisms need only check a resource's
650   expiration status when a new request for that resource is initiated.
651   See Section 14 for an explanation of the difference between caches
652   and history mechanisms.
653
6543.2.  Heuristic Expiration
655
656   Since origin servers do not always provide explicit expiration times,
657   HTTP caches typically assign heuristic expiration times, employing
658   algorithms that use other header values (such as the Last-Modified
659   time) to estimate a plausible expiration time.  The HTTP/1.1
660   specification does not provide specific algorithms, but does impose
661   worst-case constraints on their results.  Since heuristic expiration
662   times might compromise semantic transparency, they ought to be used
663   cautiously, and we encourage origin servers to provide explicit
664   expiration times as much as possible.
665
666
667
668
669
670
671Fielding, et al.          Expires July 15, 2008                [Page 12]
672
673Internet-Draft              HTTP/1.1, Part 6                January 2008
674
675
6763.3.  Age Calculations
677
678   In order to know if a cached entry is fresh, a cache needs to know if
679   its age exceeds its freshness lifetime.  We discuss how to calculate
680   the latter in Section 3.4; this section describes how to calculate
681   the age of a response or cache entry.
682
683   In this discussion, we use the term "now" to mean "the current value
684   of the clock at the host performing the calculation."  Hosts that use
685   HTTP, but especially hosts running origin servers and caches, SHOULD
686   use NTP [RFC1305] or some similar protocol to synchronize their
687   clocks to a globally accurate time standard.
688
689   HTTP/1.1 requires origin servers to send a Date header, if possible,
690   with every response, giving the time at which the response was
691   generated (see Section 8.3 of [Part1]).  We use the term "date_value"
692   to denote the value of the Date header, in a form appropriate for
693   arithmetic operations.
694
695   HTTP/1.1 uses the Age response-header to convey the estimated age of
696   the response message when obtained from a cache.  The Age field value
697   is the cache's estimate of the amount of time since the response was
698   generated or revalidated by the origin server.
699
700   In essence, the Age value is the sum of the time that the response
701   has been resident in each of the caches along the path from the
702   origin server, plus the amount of time it has been in transit along
703   network paths.
704
705   We use the term "age_value" to denote the value of the Age header, in
706   a form appropriate for arithmetic operations.
707
708   A response's age can be calculated in two entirely independent ways:
709
710   1.  now minus date_value, if the local clock is reasonably well
711       synchronized to the origin server's clock.  If the result is
712       negative, the result is replaced by zero.
713
714   2.  age_value, if all of the caches along the response path implement
715       HTTP/1.1.
716
717   Given that we have two independent ways to compute the age of a
718   response when it is received, we can combine these as
719
720       corrected_received_age = max(now - date_value, age_value)
721
722   and as long as we have either nearly synchronized clocks or all-
723   HTTP/1.1 paths, one gets a reliable (conservative) result.
724
725
726
727Fielding, et al.          Expires July 15, 2008                [Page 13]
728
729Internet-Draft              HTTP/1.1, Part 6                January 2008
730
731
732   Because of network-imposed delays, some significant interval might
733   pass between the time that a server generates a response and the time
734   it is received at the next outbound cache or client.  If uncorrected,
735   this delay could result in improperly low ages.
736
737   Because the request that resulted in the returned Age value must have
738   been initiated prior to that Age value's generation, we can correct
739   for delays imposed by the network by recording the time at which the
740   request was initiated.  Then, when an Age value is received, it MUST
741   be interpreted relative to the time the request was initiated, not
742   the time that the response was received.  This algorithm results in
743   conservative behavior no matter how much delay is experienced.  So,
744   we compute:
745
746      corrected_initial_age = corrected_received_age
747                            + (now - request_time)
748
749   where "request_time" is the time (according to the local clock) when
750   the request that elicited this response was sent.
751
752   Summary of age calculation algorithm, when a cache receives a
753   response:
754
755      /*
756       * age_value
757       *      is the value of Age: header received by the cache with
758       *              this response.
759       * date_value
760       *      is the value of the origin server's Date: header
761       * request_time
762       *      is the (local) time when the cache made the request
763       *              that resulted in this cached response
764       * response_time
765       *      is the (local) time when the cache received the
766       *              response
767       * now
768       *      is the current (local) time
769       */
770
771      apparent_age = max(0, response_time - date_value);
772      corrected_received_age = max(apparent_age, age_value);
773      response_delay = response_time - request_time;
774      corrected_initial_age = corrected_received_age + response_delay;
775      resident_time = now - response_time;
776      current_age   = corrected_initial_age + resident_time;
777
778   The current_age of a cache entry is calculated by adding the amount
779   of time (in seconds) since the cache entry was last validated by the
780
781
782
783Fielding, et al.          Expires July 15, 2008                [Page 14]
784
785Internet-Draft              HTTP/1.1, Part 6                January 2008
786
787
788   origin server to the corrected_initial_age.  When a response is
789   generated from a cache entry, the cache MUST include a single Age
790   header field in the response with a value equal to the cache entry's
791   current_age.
792
793   The presence of an Age header field in a response implies that a
794   response is not first-hand.  However, the converse is not true, since
795   the lack of an Age header field in a response does not imply that the
796   response is first-hand unless all caches along the request path are
797   compliant with HTTP/1.1 (i.e., older HTTP caches did not implement
798   the Age header field).
799
8003.4.  Expiration Calculations
801
802   In order to decide whether a response is fresh or stale, we need to
803   compare its freshness lifetime to its age.  The age is calculated as
804   described in Section 3.3; this section describes how to calculate the
805   freshness lifetime, and to determine if a response has expired.  In
806   the discussion below, the values can be represented in any form
807   appropriate for arithmetic operations.
808
809   We use the term "expires_value" to denote the value of the Expires
810   header.  We use the term "max_age_value" to denote an appropriate
811   value of the number of seconds carried by the "max-age" directive of
812   the Cache-Control header in a response (see Section 15.2.3).
813
814   The max-age directive takes priority over Expires, so if max-age is
815   present in a response, the calculation is simply:
816
817      freshness_lifetime = max_age_value
818
819   Otherwise, if Expires is present in the response, the calculation is:
820
821      freshness_lifetime = expires_value - date_value
822
823   Note that neither of these calculations is vulnerable to clock skew,
824   since all of the information comes from the origin server.
825
826   If none of Expires, Cache-Control: max-age, or Cache-Control:
827   s-maxage (see Section 15.2.3) appears in the response, and the
828   response does not include other restrictions on caching, the cache
829   MAY compute a freshness lifetime using a heuristic.  The cache MUST
830   attach Warning 113 to any response whose age is more than 24 hours if
831   such warning has not already been added.
832
833   Also, if the response does have a Last-Modified time, the heuristic
834   expiration value SHOULD be no more than some fraction of the interval
835   since that time.  A typical setting of this fraction might be 10%.
836
837
838
839Fielding, et al.          Expires July 15, 2008                [Page 15]
840
841Internet-Draft              HTTP/1.1, Part 6                January 2008
842
843
844   The calculation to determine if a response has expired is quite
845   simple:
846
847      response_is_fresh = (freshness_lifetime > current_age)
848
8493.5.  Disambiguating Expiration Values
850
851   Because expiration values are assigned optimistically, it is possible
852   for two caches to contain fresh values for the same resource that are
853   different.
854
855   If a client performing a retrieval receives a non-first-hand response
856   for a request that was already fresh in its own cache, and the Date
857   header in its existing cache entry is newer than the Date on the new
858   response, then the client MAY ignore the response.  If so, it MAY
859   retry the request with a "Cache-Control: max-age=0" directive (see
860   Section 15.2), to force a check with the origin server.
861
862   If a cache has two fresh responses for the same representation with
863   different validators, it MUST use the one with the more recent Date
864   header.  This situation might arise because the cache is pooling
865   responses from other caches, or because a client has asked for a
866   reload or a revalidation of an apparently fresh cache entry.
867
8683.6.  Disambiguating Multiple Responses
869
870   Because a client might be receiving responses via multiple paths, so
871   that some responses flow through one set of caches and other
872   responses flow through a different set of caches, a client might
873   receive responses in an order different from that in which the origin
874   server sent them.  We would like the client to use the most recently
875   generated response, even if older responses are still apparently
876   fresh.
877
878   Neither the entity tag nor the expiration value can impose an
879   ordering on responses, since it is possible that a later response
880   intentionally carries an earlier expiration time.  The Date values
881   are ordered to a granularity of one second.
882
883   When a client tries to revalidate a cache entry, and the response it
884   receives contains a Date header that appears to be older than the one
885   for the existing entry, then the client SHOULD repeat the request
886   unconditionally, and include
887
888       Cache-Control: max-age=0
889
890   to force any intermediate caches to validate their copies directly
891   with the origin server, or
892
893
894
895Fielding, et al.          Expires July 15, 2008                [Page 16]
896
897Internet-Draft              HTTP/1.1, Part 6                January 2008
898
899
900       Cache-Control: no-cache
901
902   to force any intermediate caches to obtain a new copy from the origin
903   server.
904
905   If the Date values are equal, then the client MAY use either response
906   (or MAY, if it is being extremely prudent, request a new response).
907   Servers MUST NOT depend on clients being able to choose
908   deterministically between responses generated during the same second,
909   if their expiration times overlap.
910
911
9124.  Validation Model
913
914   When a cache has a stale entry that it would like to use as a
915   response to a client's request, it first has to check with the origin
916   server (or possibly an intermediate cache with a fresh response) to
917   see if its cached entry is still usable.  We call this "validating"
918   the cache entry.  Since we do not want to have to pay the overhead of
919   retransmitting the full response if the cached entry is good, and we
920   do not want to pay the overhead of an extra round trip if the cached
921   entry is invalid, the HTTP/1.1 protocol supports the use of
922   conditional methods.
923
924   The key protocol features for supporting conditional methods are
925   those concerned with "cache validators."  When an origin server
926   generates a full response, it attaches some sort of validator to it,
927   which is kept with the cache entry.  When a client (user agent or
928   proxy cache) makes a conditional request for a resource for which it
929   has a cache entry, it includes the associated validator in the
930   request.
931
932   The server then checks that validator against the current validator
933   for the entity, and, if they match (see Section 4 of [Part4]), it
934   responds with a special status code (usually, 304 (Not Modified)) and
935   no entity-body.  Otherwise, it returns a full response (including
936   entity-body).  Thus, we avoid transmitting the full response if the
937   validator matches, and we avoid an extra round trip if it does not
938   match.
939
940   In HTTP/1.1, a conditional request looks exactly the same as a normal
941   request for the same resource, except that it carries a special
942   header (which includes the validator) that implicitly turns the
943   method (usually, GET) into a conditional.
944
945   The protocol includes both positive and negative senses of cache-
946   validating conditions.  That is, it is possible to request either
947   that a method be performed if and only if a validator matches or if
948
949
950
951Fielding, et al.          Expires July 15, 2008                [Page 17]
952
953Internet-Draft              HTTP/1.1, Part 6                January 2008
954
955
956   and only if no validators match.
957
958      Note: a response that lacks a validator may still be cached, and
959      served from cache until it expires, unless this is explicitly
960      prohibited by a cache-control directive.  However, a cache cannot
961      do a conditional retrieval if it does not have a validator for the
962      entity, which means it will not be refreshable after it expires.
963
9644.1.  Last-Modified Dates
965
966   The Last-Modified entity-header field value is often used as a cache
967   validator.  In simple terms, a cache entry is considered to be valid
968   if the entity has not been modified since the Last-Modified value.
969
9704.2.  Entity Tag Cache Validators
971
972   The ETag response-header field value, an entity tag, provides for an
973   "opaque" cache validator.  This might allow more reliable validation
974   in situations where it is inconvenient to store modification dates,
975   where the one-second resolution of HTTP date values is not
976   sufficient, or where the origin server wishes to avoid certain
977   paradoxes that might arise from the use of modification dates.
978
979   Entity Tags are described in Section 2 of [Part4].  The headers used
980   with entity tags are described in Section 6 of [Part4].
981
9824.3.  Non-validating Conditionals
983
984   The principle behind entity tags is that only the service author
985   knows the semantics of a resource well enough to select an
986   appropriate cache validation mechanism, and the specification of any
987   validator comparison function more complex than byte-equality would
988   open up a can of worms.  Thus, comparisons of any other headers
989   (except Last-Modified, for compatibility with HTTP/1.0) are never
990   used for purposes of validating a cache entry.
991
992
9935.  Response Cacheability
994
995   Unless specifically constrained by a cache-control (Section 15.2)
996   directive, a caching system MAY always store a successful response
997   (see Section 9) as a cache entry, MAY return it without validation if
998   it is fresh, and MAY return it after successful validation.  If there
999   is neither a cache validator nor an explicit expiration time
1000   associated with a response, we do not expect it to be cached, but
1001   certain caches MAY violate this expectation (for example, when little
1002   or no network connectivity is available).  A client can usually
1003   detect that such a response was taken from a cache by comparing the
1004
1005
1006
1007Fielding, et al.          Expires July 15, 2008                [Page 18]
1008
1009Internet-Draft              HTTP/1.1, Part 6                January 2008
1010
1011
1012   Date header to the current time.
1013
1014      Note: some HTTP/1.0 caches are known to violate this expectation
1015      without providing any Warning.
1016
1017   However, in some cases it might be inappropriate for a cache to
1018   retain an entity, or to return it in response to a subsequent
1019   request.  This might be because absolute semantic transparency is
1020   deemed necessary by the service author, or because of security or
1021   privacy considerations.  Certain cache-control directives are
1022   therefore provided so that the server can indicate that certain
1023   resource entities, or portions thereof, are not to be cached
1024   regardless of other considerations.
1025
1026   Note that Section 3.1 of [Part7] normally prevents a shared cache
1027   from saving and returning a response to a previous request if that
1028   request included an Authorization header.
1029
1030   A response received with a status code of 200, 203, 206, 300, 301 or
1031   410 MAY be stored by a cache and used in reply to a subsequent
1032   request, subject to the expiration mechanism, unless a cache-control
1033   directive prohibits caching.  However, a cache that does not support
1034   the Range and Content-Range headers MUST NOT cache 206 (Partial
1035   Content) responses.
1036
1037   A response received with any other status code (e.g. status codes 302
1038   and 307) MUST NOT be returned in a reply to a subsequent request
1039   unless there are cache-control directives or another header(s) that
1040   explicitly allow it.  For example, these include the following: an
1041   Expires header (Section 15.3); a "max-age", "s-maxage", "must-
1042   revalidate", "proxy-revalidate", "public" or "private" cache-control
1043   directive (Section 15.2).
1044
1045
10466.  Constructing Responses From Caches
1047
1048   The purpose of an HTTP cache is to store information received in
1049   response to requests for use in responding to future requests.  In
1050   many cases, a cache simply returns the appropriate parts of a
1051   response to the requester.  However, if the cache holds a cache entry
1052   based on a previous response, it might have to combine parts of a new
1053   response with what is held in the cache entry.
1054
10556.1.  End-to-end and Hop-by-hop Headers
1056
1057   For the purpose of defining the behavior of caches and non-caching
1058   proxies, we divide HTTP headers into two categories:
1059
1060
1061
1062
1063Fielding, et al.          Expires July 15, 2008                [Page 19]
1064
1065Internet-Draft              HTTP/1.1, Part 6                January 2008
1066
1067
1068   o  End-to-end headers, which are transmitted to the ultimate
1069      recipient of a request or response.  End-to-end headers in
1070      responses MUST be stored as part of a cache entry and MUST be
1071      transmitted in any response formed from a cache entry.
1072
1073   o  Hop-by-hop headers, which are meaningful only for a single
1074      transport-level connection, and are not stored by caches or
1075      forwarded by proxies.
1076
1077   The following HTTP/1.1 headers are hop-by-hop headers:
1078
1079   o  Connection
1080
1081   o  Keep-Alive
1082
1083   o  Proxy-Authenticate
1084
1085   o  Proxy-Authorization
1086
1087   o  TE
1088
1089   o  Trailer
1090
1091   o  Transfer-Encoding
1092
1093   o  Upgrade
1094
1095   All other headers defined by HTTP/1.1 are end-to-end headers.
1096
1097   Other hop-by-hop headers MUST be listed in a Connection header
1098   (Section 8.1 of [Part1]).
1099
11006.2.  Non-modifiable Headers
1101
1102   Some features of the HTTP/1.1 protocol, such as Digest
1103   Authentication, depend on the value of certain end-to-end headers.  A
1104   transparent proxy SHOULD NOT modify an end-to-end header unless the
1105   definition of that header requires or specifically allows that.
1106
1107   A transparent proxy MUST NOT modify any of the following fields in a
1108   request or response, and it MUST NOT add any of these fields if not
1109   already present:
1110
1111   o  Content-Location
1112
1113   o  Content-MD5
1114
1115
1116
1117
1118
1119Fielding, et al.          Expires July 15, 2008                [Page 20]
1120
1121Internet-Draft              HTTP/1.1, Part 6                January 2008
1122
1123
1124   o  ETag
1125
1126   o  Last-Modified
1127
1128   A transparent proxy MUST NOT modify any of the following fields in a
1129   response:
1130
1131   o  Expires
1132
1133   but it MAY add any of these fields if not already present.  If an
1134   Expires header is added, it MUST be given a field-value identical to
1135   that of the Date header in that response.
1136
1137   A proxy MUST NOT modify or add any of the following fields in a
1138   message that contains the no-transform cache-control directive, or in
1139   any request:
1140
1141   o  Content-Encoding
1142
1143   o  Content-Range
1144
1145   o  Content-Type
1146
1147   A non-transparent proxy MAY modify or add these fields to a message
1148   that does not include no-transform, but if it does so, it MUST add a
1149   Warning 214 (Transformation applied) if one does not already appear
1150   in the message (see Section 15.6).
1151
1152      Warning: unnecessary modification of end-to-end headers might
1153      cause authentication failures if stronger authentication
1154      mechanisms are introduced in later versions of HTTP.  Such
1155      authentication mechanisms MAY rely on the values of header fields
1156      not listed here.
1157
1158   The Content-Length field of a request or response is added or deleted
1159   according to the rules in Section 4.4 of [Part1].  A transparent
1160   proxy MUST preserve the entity-length (Section 3.2.2 of [Part3]) of
1161   the entity-body, although it MAY change the transfer-length (Section
1162   4.4 of [Part1]).
1163
11646.3.  Combining Headers
1165
1166   When a cache makes a validating request to a server, and the server
1167   provides a 304 (Not Modified) response or a 206 (Partial Content)
1168   response, the cache then constructs a response to send to the
1169   requesting client.
1170
1171   If the status code is 304 (Not Modified), the cache uses the entity-
1172
1173
1174
1175Fielding, et al.          Expires July 15, 2008                [Page 21]
1176
1177Internet-Draft              HTTP/1.1, Part 6                January 2008
1178
1179
1180   body stored in the cache entry as the entity-body of this outgoing
1181   response.  If the status code is 206 (Partial Content) and the ETag
1182   or Last-Modified headers match exactly, the cache MAY combine the
1183   contents stored in the cache entry with the new contents received in
1184   the response and use the result as the entity-body of this outgoing
1185   response, (see Section 4 of [Part5]).
1186
1187   The end-to-end headers stored in the cache entry are used for the
1188   constructed response, except that
1189
1190   o  any stored Warning headers with warn-code 1xx (see Section 15.6)
1191      MUST be deleted from the cache entry and the forwarded response.
1192
1193   o  any stored Warning headers with warn-code 2xx MUST be retained in
1194      the cache entry and the forwarded response.
1195
1196   o  any end-to-end headers provided in the 304 or 206 response MUST
1197      replace the corresponding headers from the cache entry.
1198
1199   Unless the cache decides to remove the cache entry, it MUST also
1200   replace the end-to-end headers stored with the cache entry with
1201   corresponding headers received in the incoming response, except for
1202   Warning headers as described immediately above.  If a header field-
1203   name in the incoming response matches more than one header in the
1204   cache entry, all such old headers MUST be replaced.
1205
1206   In other words, the set of end-to-end headers received in the
1207   incoming response overrides all corresponding end-to-end headers
1208   stored with the cache entry (except for stored Warning headers with
1209   warn-code 1xx, which are deleted even if not overridden).
1210
1211      Note: this rule allows an origin server to use a 304 (Not
1212      Modified) or a 206 (Partial Content) response to update any header
1213      associated with a previous response for the same entity or sub-
1214      ranges thereof, although it might not always be meaningful or
1215      correct to do so.  This rule does not allow an origin server to
1216      use a 304 (Not Modified) or a 206 (Partial Content) response to
1217      entirely delete a header that it had provided with a previous
1218      response.
1219
1220
12217.  Caching Negotiated Responses
1222
1223   Use of server-driven content negotiation (Section 4.1 of [Part3]), as
1224   indicated by the presence of a Vary header field in a response,
1225   alters the conditions and procedure by which a cache can use the
1226   response for subsequent requests.  See Section 15.5 for use of the
1227   Vary header field by servers.
1228
1229
1230
1231Fielding, et al.          Expires July 15, 2008                [Page 22]
1232
1233Internet-Draft              HTTP/1.1, Part 6                January 2008
1234
1235
1236   A server SHOULD use the Vary header field to inform a cache of what
1237   request-header fields were used to select among multiple
1238   representations of a cacheable response subject to server-driven
1239   negotiation.  The set of header fields named by the Vary field value
1240   is known as the "selecting" request-headers.
1241
1242   When the cache receives a subsequent request whose Request-URI
1243   specifies one or more cache entries including a Vary header field,
1244   the cache MUST NOT use such a cache entry to construct a response to
1245   the new request unless all of the selecting request-headers present
1246   in the new request match the corresponding stored request-headers in
1247   the original request.
1248
1249   The selecting request-headers from two requests are defined to match
1250   if and only if the selecting request-headers in the first request can
1251   be transformed to the selecting request-headers in the second request
1252   by adding or removing linear white space (LWS) at places where this
1253   is allowed by the corresponding BNF, and/or combining multiple
1254   message-header fields with the same field name following the rules
1255   about message headers in Section 4.2 of [Part1].
1256
1257   A Vary header field-value of "*" always fails to match and subsequent
1258   requests on that resource can only be properly interpreted by the
1259   origin server.
1260
1261   If the selecting request header fields for the cached entry do not
1262   match the selecting request header fields of the new request, then
1263   the cache MUST NOT use a cached entry to satisfy the request unless
1264   it first relays the new request to the origin server in a conditional
1265   request and the server responds with 304 (Not Modified), including an
1266   entity tag or Content-Location that indicates the entity to be used.
1267
1268   If an entity tag was assigned to a cached representation, the
1269   forwarded request SHOULD be conditional and include the entity tags
1270   in an If-None-Match header field from all its cache entries for the
1271   resource.  This conveys to the server the set of entities currently
1272   held by the cache, so that if any one of these entities matches the
1273   requested entity, the server can use the ETag header field in its 304
1274   (Not Modified) response to tell the cache which entry is appropriate.
1275   If the entity-tag of the new response matches that of an existing
1276   entry, the new response SHOULD be used to update the header fields of
1277   the existing entry, and the result MUST be returned to the client.
1278
1279   If any of the existing cache entries contains only partial content
1280   for the associated entity, its entity-tag SHOULD NOT be included in
1281   the If-None-Match header field unless the request is for a range that
1282   would be fully satisfied by that entry.
1283
1284
1285
1286
1287Fielding, et al.          Expires July 15, 2008                [Page 23]
1288
1289Internet-Draft              HTTP/1.1, Part 6                January 2008
1290
1291
1292   If a cache receives a successful response whose Content-Location
1293   field matches that of an existing cache entry for the same Request-
1294   URI, whose entity-tag differs from that of the existing entry, and
1295   whose Date is more recent than that of the existing entry, the
1296   existing entry SHOULD NOT be returned in response to future requests
1297   and SHOULD be deleted from the cache.
1298
1299
13008.  Shared and Non-Shared Caches
1301
1302   For reasons of security and privacy, it is necessary to make a
1303   distinction between "shared" and "non-shared" caches.  A non-shared
1304   cache is one that is accessible only to a single user.  Accessibility
1305   in this case SHOULD be enforced by appropriate security mechanisms.
1306   All other caches are considered to be "shared."  Other sections of
1307   this specification place certain constraints on the operation of
1308   shared caches in order to prevent loss of privacy or failure of
1309   access controls.
1310
1311
13129.  Errors or Incomplete Response Cache Behavior
1313
1314   A cache that receives an incomplete response (for example, with fewer
1315   bytes of data than specified in a Content-Length header) MAY store
1316   the response.  However, the cache MUST treat this as a partial
1317   response.  Partial responses MAY be combined as described in Section
1318   4 of [Part5]; the result might be a full response or might still be
1319   partial.  A cache MUST NOT return a partial response to a client
1320   without explicitly marking it as such, using the 206 (Partial
1321   Content) status code.  A cache MUST NOT return a partial response
1322   using a status code of 200 (OK).
1323
1324   If a cache receives a 5xx response while attempting to revalidate an
1325   entry, it MAY either forward this response to the requesting client,
1326   or act as if the server failed to respond.  In the latter case, it
1327   MAY return a previously received response unless the cached entry
1328   includes the "must-revalidate" cache-control directive (see
1329   Section 15.2).
1330
1331
133210.  Side Effects of GET and HEAD
1333
1334   Unless the origin server explicitly prohibits the caching of their
1335   responses, the application of GET and HEAD methods to any resources
1336   SHOULD NOT have side effects that would lead to erroneous behavior if
1337   these responses are taken from a cache.  They MAY still have side
1338   effects, but a cache is not required to consider such side effects in
1339   its caching decisions.  Caches are always expected to observe an
1340
1341
1342
1343Fielding, et al.          Expires July 15, 2008                [Page 24]
1344
1345Internet-Draft              HTTP/1.1, Part 6                January 2008
1346
1347
1348   origin server's explicit restrictions on caching.
1349
1350   We note one exception to this rule: since some applications have
1351   traditionally used GETs and HEADs with query URLs (those containing a
1352   "?" in the rel_path part) to perform operations with significant side
1353   effects, caches MUST NOT treat responses to such URIs as fresh unless
1354   the server provides an explicit expiration time.  This specifically
1355   means that responses from HTTP/1.0 servers for such URIs SHOULD NOT
1356   be taken from a cache.  See Section 8.1.1 of [Part2] for related
1357   information.
1358
1359
136011.  Invalidation After Updates or Deletions
1361
1362   The effect of certain methods performed on a resource at the origin
1363   server might cause one or more existing cache entries to become non-
1364   transparently invalid.  That is, although they might continue to be
1365   "fresh," they do not accurately reflect what the origin server would
1366   return for a new request on that resource.
1367
1368   There is no way for the HTTP protocol to guarantee that all such
1369   cache entries are marked invalid.  For example, the request that
1370   caused the change at the origin server might not have gone through
1371   the proxy where a cache entry is stored.  However, several rules help
1372   reduce the likelihood of erroneous behavior.
1373
1374   In this section, the phrase "invalidate an entity" means that the
1375   cache will either remove all instances of that entity from its
1376   storage, or will mark these as "invalid" and in need of a mandatory
1377   revalidation before they can be returned in response to a subsequent
1378   request.
1379
1380   Some HTTP methods MUST cause a cache to invalidate an entity.  This
1381   is either the entity referred to by the Request-URI, or by the
1382   Location or Content-Location headers (if present).  These methods
1383   are:
1384
1385   o  PUT
1386
1387   o  DELETE
1388
1389   o  POST
1390
1391   An invalidation based on the URI in a Location or Content-Location
1392   header MUST NOT be performed if the host part of that URI differs
1393   from the host part in the Request-URI.  This helps prevent denial of
1394   service attacks.
1395
1396
1397
1398
1399Fielding, et al.          Expires July 15, 2008                [Page 25]
1400
1401Internet-Draft              HTTP/1.1, Part 6                January 2008
1402
1403
1404   A cache that passes through requests for methods it does not
1405   understand SHOULD invalidate any entities referred to by the Request-
1406   URI.
1407
1408
140912.  Write-Through Mandatory
1410
1411   All methods that might be expected to cause modifications to the
1412   origin server's resources MUST be written through to the origin
1413   server.  This currently includes all methods except for GET and HEAD.
1414   A cache MUST NOT reply to such a request from a client before having
1415   transmitted the request to the inbound server, and having received a
1416   corresponding response from the inbound server.  This does not
1417   prevent a proxy cache from sending a 100 (Continue) response before
1418   the inbound server has sent its final reply.
1419
1420   The alternative (known as "write-back" or "copy-back" caching) is not
1421   allowed in HTTP/1.1, due to the difficulty of providing consistent
1422   updates and the problems arising from server, cache, or network
1423   failure prior to write-back.
1424
1425
142613.  Cache Replacement
1427
1428   If a new cacheable (see Sections 15.2.2, 3.5, 3.6 and 9) response is
1429   received from a resource while any existing responses for the same
1430   resource are cached, the cache SHOULD use the new response to reply
1431   to the current request.  It MAY insert it into cache storage and MAY,
1432   if it meets all other requirements, use it to respond to any future
1433   requests that would previously have caused the old response to be
1434   returned.  If it inserts the new response into cache storage the
1435   rules in Section 6.3 apply.
1436
1437      Note: a new response that has an older Date header value than
1438      existing cached responses is not cacheable.
1439
1440
144114.  History Lists
1442
1443   User agents often have history mechanisms, such as "Back" buttons and
1444   history lists, which can be used to redisplay an entity retrieved
1445   earlier in a session.
1446
1447   History mechanisms and caches are different.  In particular history
1448   mechanisms SHOULD NOT try to show a semantically transparent view of
1449   the current state of a resource.  Rather, a history mechanism is
1450   meant to show exactly what the user saw at the time when the resource
1451   was retrieved.
1452
1453
1454
1455Fielding, et al.          Expires July 15, 2008                [Page 26]
1456
1457Internet-Draft              HTTP/1.1, Part 6                January 2008
1458
1459
1460   By default, an expiration time does not apply to history mechanisms.
1461   If the entity is still in storage, a history mechanism SHOULD display
1462   it even if the entity has expired, unless the user has specifically
1463   configured the agent to refresh expired history documents.
1464
1465   This is not to be construed to prohibit the history mechanism from
1466   telling the user that a view might be stale.
1467
1468      Note: if history list mechanisms unnecessarily prevent users from
1469      viewing stale resources, this will tend to force service authors
1470      to avoid using HTTP expiration controls and cache controls when
1471      they would otherwise like to.  Service authors may consider it
1472      important that users not be presented with error messages or
1473      warning messages when they use navigation controls (such as BACK)
1474      to view previously fetched resources.  Even though sometimes such
1475      resources ought not be cached, or ought to expire quickly, user
1476      interface considerations may force service authors to resort to
1477      other means of preventing caching (e.g. "once-only" URLs) in order
1478      not to suffer the effects of improperly functioning history
1479      mechanisms.
1480
1481
148215.  Header Field Definitions
1483
1484   This section defines the syntax and semantics of HTTP/1.1 header
1485   fields related to caching.
1486
1487   For entity-header fields, both sender and recipient refer to either
1488   the client or the server, depending on who sends and who receives the
1489   entity.
1490
149115.1.  Age
1492
1493   The Age response-header field conveys the sender's estimate of the
1494   amount of time since the response (or its revalidation) was generated
1495   at the origin server.  A cached response is "fresh" if its age does
1496   not exceed its freshness lifetime.  Age values are calculated as
1497   specified in Section 3.3.
1498
1499     Age = "Age" ":" age-value
1500     age-value = delta-seconds
1501
1502   Age values are non-negative decimal integers, representing time in
1503   seconds.
1504
1505     delta-seconds  = 1*DIGIT
1506
1507   If a cache receives a value larger than the largest positive integer
1508
1509
1510
1511Fielding, et al.          Expires July 15, 2008                [Page 27]
1512
1513Internet-Draft              HTTP/1.1, Part 6                January 2008
1514
1515
1516   it can represent, or if any of its age calculations overflows, it
1517   MUST transmit an Age header with a value of 2147483648 (2^31).  An
1518   HTTP/1.1 server that includes a cache MUST include an Age header
1519   field in every response generated from its own cache.  Caches SHOULD
1520   use an arithmetic type of at least 31 bits of range.
1521
152215.2.  Cache-Control
1523
1524   The Cache-Control general-header field is used to specify directives
1525   that MUST be obeyed by all caching mechanisms along the request/
1526   response chain.  The directives specify behavior intended to prevent
1527   caches from adversely interfering with the request or response.
1528   These directives typically override the default caching algorithms.
1529   Cache directives are unidirectional in that the presence of a
1530   directive in a request does not imply that the same directive is to
1531   be given in the response.
1532
1533      Note that HTTP/1.0 caches might not implement Cache-Control and
1534      might only implement Pragma: no-cache (see Section 15.4).
1535
1536   Cache directives MUST be passed through by a proxy or gateway
1537   application, regardless of their significance to that application,
1538   since the directives might be applicable to all recipients along the
1539   request/response chain.  It is not possible to specify a cache-
1540   directive for a specific cache.
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567Fielding, et al.          Expires July 15, 2008                [Page 28]
1568
1569Internet-Draft              HTTP/1.1, Part 6                January 2008
1570
1571
1572    Cache-Control   = "Cache-Control" ":" 1#cache-directive
1573
1574    cache-directive = cache-request-directive
1575         | cache-response-directive
1576
1577    cache-request-directive =
1578           "no-cache"                          ; Section 15.2.1
1579         | "no-store"                          ; Section 15.2.2
1580         | "max-age" "=" delta-seconds         ; Section 15.2.3, 15.2.4
1581         | "max-stale" [ "=" delta-seconds ]   ; Section 15.2.3
1582         | "min-fresh" "=" delta-seconds       ; Section 15.2.3
1583         | "no-transform"                      ; Section 15.2.5
1584         | "only-if-cached"                    ; Section 15.2.4
1585         | cache-extension                     ; Section 15.2.6
1586
1587    cache-response-directive =
1588           "public"                               ; Section 15.2.1
1589         | "private" [ "=" DQUOTE 1#field-name DQUOTE ] ; Section 15.2.1
1590         | "no-cache" [ "=" DQUOTE 1#field-name DQUOTE ]; Section 15.2.1
1591         | "no-store"                             ; Section 15.2.2
1592         | "no-transform"                         ; Section 15.2.5
1593         | "must-revalidate"                      ; Section 15.2.4
1594         | "proxy-revalidate"                     ; Section 15.2.4
1595         | "max-age" "=" delta-seconds            ; Section 15.2.3
1596         | "s-maxage" "=" delta-seconds           ; Section 15.2.3
1597         | cache-extension                        ; Section 15.2.6
1598
1599    cache-extension = token [ "=" ( token | quoted-string ) ]
1600
1601   When a directive appears without any 1#field-name parameter, the
1602   directive applies to the entire request or response.  When such a
1603   directive appears with a 1#field-name parameter, it applies only to
1604   the named field or fields, and not to the rest of the request or
1605   response.  This mechanism supports extensibility; implementations of
1606   future versions of the HTTP protocol might apply these directives to
1607   header fields not defined in HTTP/1.1.
1608
1609   The cache-control directives can be broken down into these general
1610   categories:
1611
1612   o  Restrictions on what are cacheable; these may only be imposed by
1613      the origin server.
1614
1615   o  Restrictions on what may be stored by a cache; these may be
1616      imposed by either the origin server or the user agent.
1617
1618   o  Modifications of the basic expiration mechanism; these may be
1619      imposed by either the origin server or the user agent.
1620
1621
1622
1623Fielding, et al.          Expires July 15, 2008                [Page 29]
1624
1625Internet-Draft              HTTP/1.1, Part 6                January 2008
1626
1627
1628   o  Controls over cache revalidation and reload; these may only be
1629      imposed by a user agent.
1630
1631   o  Control over transformation of entities.
1632
1633   o  Extensions to the caching system.
1634
163515.2.1.  What is Cacheable
1636
1637   By default, a response is cacheable if the requirements of the
1638   request method, request header fields, and the response status
1639   indicate that it is cacheable.  Section 5 summarizes these defaults
1640   for cacheability.  The following Cache-Control response directives
1641   allow an origin server to override the default cacheability of a
1642   response:
1643
1644   public
1645
1646      Indicates that the response MAY be cached by any cache, even if it
1647      would normally be non-cacheable or cacheable only within a non-
1648      shared cache.  (See also Authorization, Section 3.1 of [Part7],
1649      for additional details.)
1650
1651   private
1652
1653      Indicates that all or part of the response message is intended for
1654      a single user and MUST NOT be cached by a shared cache.  This
1655      allows an origin server to state that the specified parts of the
1656      response are intended for only one user and are not a valid
1657      response for requests by other users.  A private (non-shared)
1658      cache MAY cache the response.
1659
1660      Note: This usage of the word private only controls where the
1661      response may be cached, and cannot ensure the privacy of the
1662      message content.
1663
1664   no-cache
1665
1666      If the no-cache directive does not specify a field-name, then a
1667      cache MUST NOT use the response to satisfy a subsequent request
1668      without successful revalidation with the origin server.  This
1669      allows an origin server to prevent caching even by caches that
1670      have been configured to return stale responses to client requests.
1671
1672      If the no-cache directive does specify one or more field-names,
1673      then a cache MAY use the response to satisfy a subsequent request,
1674      subject to any other restrictions on caching.  However, the
1675      specified field-name(s) MUST NOT be sent in the response to a
1676
1677
1678
1679Fielding, et al.          Expires July 15, 2008                [Page 30]
1680
1681Internet-Draft              HTTP/1.1, Part 6                January 2008
1682
1683
1684      subsequent request without successful revalidation with the origin
1685      server.  This allows an origin server to prevent the re-use of
1686      certain header fields in a response, while still allowing caching
1687      of the rest of the response.
1688
1689         Note: Most HTTP/1.0 caches will not recognize or obey this
1690         directive.
1691
169215.2.2.  What May be Stored by Caches
1693
1694   no-store
1695
1696      The purpose of the no-store directive is to prevent the
1697      inadvertent release or retention of sensitive information (for
1698      example, on backup tapes).  The no-store directive applies to the
1699      entire message, and MAY be sent either in a response or in a
1700      request.  If sent in a request, a cache MUST NOT store any part of
1701      either this request or any response to it.  If sent in a response,
1702      a cache MUST NOT store any part of either this response or the
1703      request that elicited it.  This directive applies to both non-
1704      shared and shared caches.  "MUST NOT store" in this context means
1705      that the cache MUST NOT intentionally store the information in
1706      non-volatile storage, and MUST make a best-effort attempt to
1707      remove the information from volatile storage as promptly as
1708      possible after forwarding it.
1709
1710      Even when this directive is associated with a response, users
1711      might explicitly store such a response outside of the caching
1712      system (e.g., with a "Save As" dialog).  History buffers MAY store
1713      such responses as part of their normal operation.
1714
1715      The purpose of this directive is to meet the stated requirements
1716      of certain users and service authors who are concerned about
1717      accidental releases of information via unanticipated accesses to
1718      cache data structures.  While the use of this directive might
1719      improve privacy in some cases, we caution that it is NOT in any
1720      way a reliable or sufficient mechanism for ensuring privacy.  In
1721      particular, malicious or compromised caches might not recognize or
1722      obey this directive, and communications networks might be
1723      vulnerable to eavesdropping.
1724
172515.2.3.  Modifications of the Basic Expiration Mechanism
1726
1727   The expiration time of an entity MAY be specified by the origin
1728   server using the Expires header (see Section 15.3).  Alternatively,
1729   it MAY be specified using the max-age directive in a response.  When
1730   the max-age cache-control directive is present in a cached response,
1731   the response is stale if its current age is greater than the age
1732
1733
1734
1735Fielding, et al.          Expires July 15, 2008                [Page 31]
1736
1737Internet-Draft              HTTP/1.1, Part 6                January 2008
1738
1739
1740   value given (in seconds) at the time of a new request for that
1741   resource.  The max-age directive on a response implies that the
1742   response is cacheable (i.e., "public") unless some other, more
1743   restrictive cache directive is also present.
1744
1745   If a response includes both an Expires header and a max-age
1746   directive, the max-age directive overrides the Expires header, even
1747   if the Expires header is more restrictive.  This rule allows an
1748   origin server to provide, for a given response, a longer expiration
1749   time to an HTTP/1.1 (or later) cache than to an HTTP/1.0 cache.  This
1750   might be useful if certain HTTP/1.0 caches improperly calculate ages
1751   or expiration times, perhaps due to desynchronized clocks.
1752
1753   Many HTTP/1.0 cache implementations will treat an Expires value that
1754   is less than or equal to the response Date value as being equivalent
1755   to the Cache-Control response directive "no-cache".  If an HTTP/1.1
1756   cache receives such a response, and the response does not include a
1757   Cache-Control header field, it SHOULD consider the response to be
1758   non-cacheable in order to retain compatibility with HTTP/1.0 servers.
1759
1760      Note: An origin server might wish to use a relatively new HTTP
1761      cache control feature, such as the "private" directive, on a
1762      network including older caches that do not understand that
1763      feature.  The origin server will need to combine the new feature
1764      with an Expires field whose value is less than or equal to the
1765      Date value.  This will prevent older caches from improperly
1766      caching the response.
1767
1768   s-maxage
1769
1770      If a response includes an s-maxage directive, then for a shared
1771      cache (but not for a private cache), the maximum age specified by
1772      this directive overrides the maximum age specified by either the
1773      max-age directive or the Expires header.  The s-maxage directive
1774      also implies the semantics of the proxy-revalidate directive (see
1775      Section 15.2.4), i.e., that the shared cache must not use the
1776      entry after it becomes stale to respond to a subsequent request
1777      without first revalidating it with the origin server.  The
1778      s-maxage directive is always ignored by a private cache.
1779
1780   Note that most older caches, not compliant with this specification,
1781   do not implement any cache-control directives.  An origin server
1782   wishing to use a cache-control directive that restricts, but does not
1783   prevent, caching by an HTTP/1.1-compliant cache MAY exploit the
1784   requirement that the max-age directive overrides the Expires header,
1785   and the fact that pre-HTTP/1.1-compliant caches do not observe the
1786   max-age directive.
1787
1788
1789
1790
1791Fielding, et al.          Expires July 15, 2008                [Page 32]
1792
1793Internet-Draft              HTTP/1.1, Part 6                January 2008
1794
1795
1796   Other directives allow a user agent to modify the basic expiration
1797   mechanism.  These directives MAY be specified on a request:
1798
1799   max-age
1800
1801      Indicates that the client is willing to accept a response whose
1802      age is no greater than the specified time in seconds.  Unless max-
1803      stale directive is also included, the client is not willing to
1804      accept a stale response.
1805
1806   min-fresh
1807
1808      Indicates that the client is willing to accept a response whose
1809      freshness lifetime is no less than its current age plus the
1810      specified time in seconds.  That is, the client wants a response
1811      that will still be fresh for at least the specified number of
1812      seconds.
1813
1814   max-stale
1815
1816      Indicates that the client is willing to accept a response that has
1817      exceeded its expiration time.  If max-stale is assigned a value,
1818      then the client is willing to accept a response that has exceeded
1819      its expiration time by no more than the specified number of
1820      seconds.  If no value is assigned to max-stale, then the client is
1821      willing to accept a stale response of any age.
1822
1823   If a cache returns a stale response, either because of a max-stale
1824   directive on a request, or because the cache is configured to
1825   override the expiration time of a response, the cache MUST attach a
1826   Warning header to the stale response, using Warning 110 (Response is
1827   stale).
1828
1829   A cache MAY be configured to return stale responses without
1830   validation, but only if this does not conflict with any "MUST"-level
1831   requirements concerning cache validation (e.g., a "must-revalidate"
1832   cache-control directive).
1833
1834   If both the new request and the cached entry include "max-age"
1835   directives, then the lesser of the two values is used for determining
1836   the freshness of the cached entry for that request.
1837
183815.2.4.  Cache Revalidation and Reload Controls
1839
1840   Sometimes a user agent might want or need to insist that a cache
1841   revalidate its cache entry with the origin server (and not just with
1842   the next cache along the path to the origin server), or to reload its
1843   cache entry from the origin server.  End-to-end revalidation might be
1844
1845
1846
1847Fielding, et al.          Expires July 15, 2008                [Page 33]
1848
1849Internet-Draft              HTTP/1.1, Part 6                January 2008
1850
1851
1852   necessary if either the cache or the origin server has overestimated
1853   the expiration time of the cached response.  End-to-end reload may be
1854   necessary if the cache entry has become corrupted for some reason.
1855
1856   End-to-end revalidation may be requested either when the client does
1857   not have its own local cached copy, in which case we call it
1858   "unspecified end-to-end revalidation", or when the client does have a
1859   local cached copy, in which case we call it "specific end-to-end
1860   revalidation."
1861
1862   The client can specify these three kinds of action using Cache-
1863   Control request directives:
1864
1865   End-to-end reload
1866
1867      The request includes a "no-cache" cache-control directive or, for
1868      compatibility with HTTP/1.0 clients, "Pragma: no-cache".  Field
1869      names MUST NOT be included with the no-cache directive in a
1870      request.  The server MUST NOT use a cached copy when responding to
1871      such a request.
1872
1873   Specific end-to-end revalidation
1874
1875      The request includes a "max-age=0" cache-control directive, which
1876      forces each cache along the path to the origin server to
1877      revalidate its own entry, if any, with the next cache or server.
1878      The initial request includes a cache-validating conditional with
1879      the client's current validator.
1880
1881   Unspecified end-to-end revalidation
1882
1883      The request includes "max-age=0" cache-control directive, which
1884      forces each cache along the path to the origin server to
1885      revalidate its own entry, if any, with the next cache or server.
1886      The initial request does not include a cache-validating
1887      conditional; the first cache along the path (if any) that holds a
1888      cache entry for this resource includes a cache-validating
1889      conditional with its current validator.
1890
1891   max-age
1892
1893      When an intermediate cache is forced, by means of a max-age=0
1894      directive, to revalidate its own cache entry, and the client has
1895      supplied its own validator in the request, the supplied validator
1896      might differ from the validator currently stored with the cache
1897      entry.  In this case, the cache MAY use either validator in making
1898      its own request without affecting semantic transparency.
1899
1900
1901
1902
1903Fielding, et al.          Expires July 15, 2008                [Page 34]
1904
1905Internet-Draft              HTTP/1.1, Part 6                January 2008
1906
1907
1908      However, the choice of validator might affect performance.  The
1909      best approach is for the intermediate cache to use its own
1910      validator when making its request.  If the server replies with 304
1911      (Not Modified), then the cache can return its now validated copy
1912      to the client with a 200 (OK) response.  If the server replies
1913      with a new entity and cache validator, however, the intermediate
1914      cache can compare the returned validator with the one provided in
1915      the client's request, using the strong comparison function.  If
1916      the client's validator is equal to the origin server's, then the
1917      intermediate cache simply returns 304 (Not Modified).  Otherwise,
1918      it returns the new entity with a 200 (OK) response.
1919
1920      If a request includes the no-cache directive, it SHOULD NOT
1921      include min-fresh, max-stale, or max-age.
1922
1923   only-if-cached
1924
1925      In some cases, such as times of extremely poor network
1926      connectivity, a client may want a cache to return only those
1927      responses that it currently has stored, and not to reload or
1928      revalidate with the origin server.  To do this, the client may
1929      include the only-if-cached directive in a request.  If it receives
1930      this directive, a cache SHOULD either respond using a cached entry
1931      that is consistent with the other constraints of the request, or
1932      respond with a 504 (Gateway Timeout) status.  However, if a group
1933      of caches is being operated as a unified system with good internal
1934      connectivity, such a request MAY be forwarded within that group of
1935      caches.
1936
1937   must-revalidate
1938
1939      Because a cache MAY be configured to ignore a server's specified
1940      expiration time, and because a client request MAY include a max-
1941      stale directive (which has a similar effect), the protocol also
1942      includes a mechanism for the origin server to require revalidation
1943      of a cache entry on any subsequent use.  When the must-revalidate
1944      directive is present in a response received by a cache, that cache
1945      MUST NOT use the entry after it becomes stale to respond to a
1946      subsequent request without first revalidating it with the origin
1947      server.  (I.e., the cache MUST do an end-to-end revalidation every
1948      time, if, based solely on the origin server's Expires or max-age
1949      value, the cached response is stale.)
1950
1951      The must-revalidate directive is necessary to support reliable
1952      operation for certain protocol features.  In all circumstances an
1953      HTTP/1.1 cache MUST obey the must-revalidate directive; in
1954      particular, if the cache cannot reach the origin server for any
1955      reason, it MUST generate a 504 (Gateway Timeout) response.
1956
1957
1958
1959Fielding, et al.          Expires July 15, 2008                [Page 35]
1960
1961Internet-Draft              HTTP/1.1, Part 6                January 2008
1962
1963
1964      Servers SHOULD send the must-revalidate directive if and only if
1965      failure to revalidate a request on the entity could result in
1966      incorrect operation, such as a silently unexecuted financial
1967      transaction.  Recipients MUST NOT take any automated action that
1968      violates this directive, and MUST NOT automatically provide an
1969      unvalidated copy of the entity if revalidation fails.
1970
1971      Although this is not recommended, user agents operating under
1972      severe connectivity constraints MAY violate this directive but, if
1973      so, MUST explicitly warn the user that an unvalidated response has
1974      been provided.  The warning MUST be provided on each unvalidated
1975      access, and SHOULD require explicit user confirmation.
1976
1977   proxy-revalidate
1978
1979      The proxy-revalidate directive has the same meaning as the must-
1980      revalidate directive, except that it does not apply to non-shared
1981      user agent caches.  It can be used on a response to an
1982      authenticated request to permit the user's cache to store and
1983      later return the response without needing to revalidate it (since
1984      it has already been authenticated once by that user), while still
1985      requiring proxies that service many users to revalidate each time
1986      (in order to make sure that each user has been authenticated).
1987      Note that such authenticated responses also need the public cache
1988      control directive in order to allow them to be cached at all.
1989
199015.2.5.  No-Transform Directive
1991
1992   no-transform
1993
1994      Implementors of intermediate caches (proxies) have found it useful
1995      to convert the media type of certain entity bodies.  A non-
1996      transparent proxy might, for example, convert between image
1997      formats in order to save cache space or to reduce the amount of
1998      traffic on a slow link.
1999
2000      Serious operational problems occur, however, when these
2001      transformations are applied to entity bodies intended for certain
2002      kinds of applications.  For example, applications for medical
2003      imaging, scientific data analysis and those using end-to-end
2004      authentication, all depend on receiving an entity body that is bit
2005      for bit identical to the original entity-body.
2006
2007      Therefore, if a message includes the no-transform directive, an
2008      intermediate cache or proxy MUST NOT change those headers that are
2009      listed in Section 6.2 as being subject to the no-transform
2010      directive.  This implies that the cache or proxy MUST NOT change
2011      any aspect of the entity-body that is specified by these headers,
2012
2013
2014
2015Fielding, et al.          Expires July 15, 2008                [Page 36]
2016
2017Internet-Draft              HTTP/1.1, Part 6                January 2008
2018
2019
2020      including the value of the entity-body itself.
2021
202215.2.6.  Cache Control Extensions
2023
2024   The Cache-Control header field can be extended through the use of one
2025   or more cache-extension tokens, each with an optional assigned value.
2026   Informational extensions (those which do not require a change in
2027   cache behavior) MAY be added without changing the semantics of other
2028   directives.  Behavioral extensions are designed to work by acting as
2029   modifiers to the existing base of cache directives.  Both the new
2030   directive and the standard directive are supplied, such that
2031   applications which do not understand the new directive will default
2032   to the behavior specified by the standard directive, and those that
2033   understand the new directive will recognize it as modifying the
2034   requirements associated with the standard directive.  In this way,
2035   extensions to the cache-control directives can be made without
2036   requiring changes to the base protocol.
2037
2038   This extension mechanism depends on an HTTP cache obeying all of the
2039   cache-control directives defined for its native HTTP-version, obeying
2040   certain extensions, and ignoring all directives that it does not
2041   understand.
2042
2043   For example, consider a hypothetical new response directive called
2044   community which acts as a modifier to the private directive.  We
2045   define this new directive to mean that, in addition to any non-shared
2046   cache, any cache which is shared only by members of the community
2047   named within its value may cache the response.  An origin server
2048   wishing to allow the UCI community to use an otherwise private
2049   response in their shared cache(s) could do so by including
2050
2051       Cache-Control: private, community="UCI"
2052
2053   A cache seeing this header field will act correctly even if the cache
2054   does not understand the community cache-extension, since it will also
2055   see and understand the private directive and thus default to the safe
2056   behavior.
2057
2058   Unrecognized cache-directives MUST be ignored; it is assumed that any
2059   cache-directive likely to be unrecognized by an HTTP/1.1 cache will
2060   be combined with standard directives (or the response's default
2061   cacheability) such that the cache behavior will remain minimally
2062   correct even if the cache does not understand the extension(s).
2063
206415.3.  Expires
2065
2066   The Expires entity-header field gives the date/time after which the
2067   response is considered stale.  A stale cache entry may not normally
2068
2069
2070
2071Fielding, et al.          Expires July 15, 2008                [Page 37]
2072
2073Internet-Draft              HTTP/1.1, Part 6                January 2008
2074
2075
2076   be returned by a cache (either a proxy cache or a user agent cache)
2077   unless it is first validated with the origin server (or with an
2078   intermediate cache that has a fresh copy of the entity).  See
2079   Section 3 for further discussion of the expiration model.
2080
2081   The presence of an Expires field does not imply that the original
2082   resource will change or cease to exist at, before, or after that
2083   time.
2084
2085   The format is an absolute date and time as defined by HTTP-date in
2086   Section 3.3.1 of [Part1]; it MUST be sent in rfc1123-date format.
2087
2088     Expires = "Expires" ":" HTTP-date
2089
2090   An example of its use is
2091
2092      Expires: Thu, 01 Dec 1994 16:00:00 GMT
2093
2094      Note: if a response includes a Cache-Control field with the max-
2095      age directive (see Section 15.2.3), that directive overrides the
2096      Expires field.
2097
2098   HTTP/1.1 clients and caches MUST treat other invalid date formats,
2099   especially including the value "0", as in the past (i.e., "already
2100   expired").
2101
2102   To mark a response as "already expired," an origin server sends an
2103   Expires date that is equal to the Date header value.  (See the rules
2104   for expiration calculations in Section 3.4.)
2105
2106   To mark a response as "never expires," an origin server sends an
2107   Expires date approximately one year from the time the response is
2108   sent.  HTTP/1.1 servers SHOULD NOT send Expires dates more than one
2109   year in the future.
2110
2111   The presence of an Expires header field with a date value of some
2112   time in the future on a response that otherwise would by default be
2113   non-cacheable indicates that the response is cacheable, unless
2114   indicated otherwise by a Cache-Control header field (Section 15.2).
2115
211615.4.  Pragma
2117
2118   The Pragma general-header field is used to include implementation-
2119   specific directives that might apply to any recipient along the
2120   request/response chain.  All pragma directives specify optional
2121   behavior from the viewpoint of the protocol; however, some systems
2122   MAY require that behavior be consistent with the directives.
2123
2124
2125
2126
2127Fielding, et al.          Expires July 15, 2008                [Page 38]
2128
2129Internet-Draft              HTTP/1.1, Part 6                January 2008
2130
2131
2132     Pragma            = "Pragma" ":" 1#pragma-directive
2133     pragma-directive  = "no-cache" | extension-pragma
2134     extension-pragma  = token [ "=" ( token | quoted-string ) ]
2135
2136   When the no-cache directive is present in a request message, an
2137   application SHOULD forward the request toward the origin server even
2138   if it has a cached copy of what is being requested.  This pragma
2139   directive has the same semantics as the no-cache cache-directive (see
2140   Section 15.2) and is defined here for backward compatibility with
2141   HTTP/1.0.  Clients SHOULD include both header fields when a no-cache
2142   request is sent to a server not known to be HTTP/1.1 compliant.
2143
2144   Pragma directives MUST be passed through by a proxy or gateway
2145   application, regardless of their significance to that application,
2146   since the directives might be applicable to all recipients along the
2147   request/response chain.  It is not possible to specify a pragma for a
2148   specific recipient; however, any pragma directive not relevant to a
2149   recipient SHOULD be ignored by that recipient.
2150
2151   HTTP/1.1 caches SHOULD treat "Pragma: no-cache" as if the client had
2152   sent "Cache-Control: no-cache".  No new Pragma directives will be
2153   defined in HTTP.
2154
2155      Note: because the meaning of "Pragma: no-cache" as a response-
2156      header field is not actually specified, it does not provide a
2157      reliable replacement for "Cache-Control: no-cache" in a response.
2158
215915.5.  Vary
2160
2161   The Vary field value indicates the set of request-header fields that
2162   fully determines, while the response is fresh, whether a cache is
2163   permitted to use the response to reply to a subsequent request
2164   without revalidation.  For uncacheable or stale responses, the Vary
2165   field value advises the user agent about the criteria that were used
2166   to select the representation.  A Vary field value of "*" implies that
2167   a cache cannot determine from the request headers of a subsequent
2168   request whether this response is the appropriate representation.  See
2169   Section 7 for use of the Vary header field by caches.
2170
2171     Vary  = "Vary" ":" ( "*" | 1#field-name )
2172
2173   An HTTP/1.1 server SHOULD include a Vary header field with any
2174   cacheable response that is subject to server-driven negotiation.
2175   Doing so allows a cache to properly interpret future requests on that
2176   resource and informs the user agent about the presence of negotiation
2177   on that resource.  A server MAY include a Vary header field with a
2178   non-cacheable response that is subject to server-driven negotiation,
2179   since this might provide the user agent with useful information about
2180
2181
2182
2183Fielding, et al.          Expires July 15, 2008                [Page 39]
2184
2185Internet-Draft              HTTP/1.1, Part 6                January 2008
2186
2187
2188   the dimensions over which the response varies at the time of the
2189   response.
2190
2191   A Vary field value consisting of a list of field-names signals that
2192   the representation selected for the response is based on a selection
2193   algorithm which considers ONLY the listed request-header field values
2194   in selecting the most appropriate representation.  A cache MAY assume
2195   that the same selection will be made for future requests with the
2196   same values for the listed field names, for the duration of time for
2197   which the response is fresh.
2198
2199   The field-names given are not limited to the set of standard request-
2200   header fields defined by this specification.  Field names are case-
2201   insensitive.
2202
2203   A Vary field value of "*" signals that unspecified parameters not
2204   limited to the request-headers (e.g., the network address of the
2205   client), play a role in the selection of the response representation.
2206   The "*" value MUST NOT be generated by a proxy server; it may only be
2207   generated by an origin server.
2208
220915.6.  Warning
2210
2211   The Warning general-header field is used to carry additional
2212   information about the status or transformation of a message which
2213   might not be reflected in the message.  This information is typically
2214   used to warn about a possible lack of semantic transparency from
2215   caching operations or transformations applied to the entity body of
2216   the message.
2217
2218   Warning headers are sent with responses using:
2219
2220     Warning    = "Warning" ":" 1#warning-value
2221
2222     warning-value = warn-code SP warn-agent SP warn-text
2223                                           [SP warn-date]
2224
2225     warn-code  = 3DIGIT
2226     warn-agent = ( host [ ":" port ] ) | pseudonym
2227                     ; the name or pseudonym of the server adding
2228                     ; the Warning header, for use in debugging
2229     warn-text  = quoted-string
2230     warn-date  = DQUOTE HTTP-date DQUOTE
2231
2232   A response MAY carry more than one Warning header.
2233
2234   The warn-text SHOULD be in a natural language and character set that
2235   is most likely to be intelligible to the human user receiving the
2236
2237
2238
2239Fielding, et al.          Expires July 15, 2008                [Page 40]
2240
2241Internet-Draft              HTTP/1.1, Part 6                January 2008
2242
2243
2244   response.  This decision MAY be based on any available knowledge,
2245   such as the location of the cache or user, the Accept-Language field
2246   in a request, the Content-Language field in a response, etc.  The
2247   default language is English and the default character set is ISO-
2248   8859-1 ([ISO-8859-1]).
2249
2250   If a character set other than ISO-8859-1 is used, it MUST be encoded
2251   in the warn-text using the method described in [RFC2047].
2252
2253   Warning headers can in general be applied to any message, however
2254   some specific warn-codes are specific to caches and can only be
2255   applied to response messages.  New Warning headers SHOULD be added
2256   after any existing Warning headers.  A cache MUST NOT delete any
2257   Warning header that it received with a message.  However, if a cache
2258   successfully validates a cache entry, it SHOULD remove any Warning
2259   headers previously attached to that entry except as specified for
2260   specific Warning codes.  It MUST then add any Warning headers
2261   received in the validating response.  In other words, Warning headers
2262   are those that would be attached to the most recent relevant
2263   response.
2264
2265   When multiple Warning headers are attached to a response, the user
2266   agent ought to inform the user of as many of them as possible, in the
2267   order that they appear in the response.  If it is not possible to
2268   inform the user of all of the warnings, the user agent SHOULD follow
2269   these heuristics:
2270
2271   o  Warnings that appear early in the response take priority over
2272      those appearing later in the response.
2273
2274   o  Warnings in the user's preferred character set take priority over
2275      warnings in other character sets but with identical warn-codes and
2276      warn-agents.
2277
2278   Systems that generate multiple Warning headers SHOULD order them with
2279   this user agent behavior in mind.
2280
2281   Requirements for the behavior of caches with respect to Warnings are
2282   stated in Section 2.2.
2283
2284   This is a list of the currently-defined warn-codes, each with a
2285   recommended warn-text in English, and a description of its meaning.
2286
2287   110 Response is stale
2288
2289      MUST be included whenever the returned response is stale.
2290
2291   111 Revalidation failed
2292
2293
2294
2295Fielding, et al.          Expires July 15, 2008                [Page 41]
2296
2297Internet-Draft              HTTP/1.1, Part 6                January 2008
2298
2299
2300      MUST be included if a cache returns a stale response because an
2301      attempt to revalidate the response failed, due to an inability to
2302      reach the server.
2303
2304   112 Disconnected operation
2305
2306      SHOULD be included if the cache is intentionally disconnected from
2307      the rest of the network for a period of time.
2308
2309   113 Heuristic expiration
2310
2311      MUST be included if the cache heuristically chose a freshness
2312      lifetime greater than 24 hours and the response's age is greater
2313      than 24 hours.
2314
2315   199 Miscellaneous warning
2316
2317      The warning text MAY include arbitrary information to be presented
2318      to a human user, or logged.  A system receiving this warning MUST
2319      NOT take any automated action, besides presenting the warning to
2320      the user.
2321
2322   214 Transformation applied
2323
2324      MUST be added by an intermediate cache or proxy if it applies any
2325      transformation changing the content-coding (as specified in the
2326      Content-Encoding header) or media-type (as specified in the
2327      Content-Type header) of the response, or the entity-body of the
2328      response, unless this Warning code already appears in the
2329      response.
2330
2331   299 Miscellaneous persistent warning
2332
2333      The warning text MAY include arbitrary information to be presented
2334      to a human user, or logged.  A system receiving this warning MUST
2335      NOT take any automated action.
2336
2337   If an implementation sends a message with one or more Warning headers
2338   whose version is HTTP/1.0 or lower, then the sender MUST include in
2339   each warning-value a warn-date that matches the date in the response.
2340
2341   If an implementation receives a message with a warning-value that
2342   includes a warn-date, and that warn-date is different from the Date
2343   value in the response, then that warning-value MUST be deleted from
2344   the message before storing, forwarding, or using it.  (This prevents
2345   bad consequences of naive caching of Warning header fields.)  If all
2346   of the warning-values are deleted for this reason, the Warning header
2347   MUST be deleted as well.
2348
2349
2350
2351Fielding, et al.          Expires July 15, 2008                [Page 42]
2352
2353Internet-Draft              HTTP/1.1, Part 6                January 2008
2354
2355
235616.  IANA Considerations
2357
2358   TBD.
2359
2360
236117.  Security Considerations
2362
2363   Caching proxies provide additional potential vulnerabilities, since
2364   the contents of the cache represent an attractive target for
2365   malicious exploitation.  Because cache contents persist after an HTTP
2366   request is complete, an attack on the cache can reveal information
2367   long after a user believes that the information has been removed from
2368   the network.  Therefore, cache contents should be protected as
2369   sensitive information.
2370
2371
237218.  Acknowledgments
2373
2374   Much of the content and presentation of the caching design is due to
2375   suggestions and comments from individuals including: Shel Kaphan,
2376   Paul Leach, Koen Holtman, David Morris, and Larry Masinter.
2377
2378
237919.  References
2380
238119.1.  Normative References
2382
2383   [ISO-8859-1]
2384              International Organization for Standardization,
2385              "Information technology -- 8-bit single-byte coded graphic
2386              character sets -- Part 1: Latin alphabet No. 1", ISO/
2387              IEC 8859-1:1998, 1998.
2388
2389   [Part1]    Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
2390              Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
2391              and J. Reschke, Ed., "HTTP/1.1, part 1: URIs, Connections,
2392              and Message Parsing", draft-ietf-httpbis-p1-messaging-01
2393              (work in progress), January 2008.
2394
2395   [Part2]    Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
2396              Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
2397              and J. Reschke, Ed., "HTTP/1.1, part 2: Message
2398              Semantics", draft-ietf-httpbis-p2-semantics-01 (work in
2399              progress), January 2008.
2400
2401   [Part3]    Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
2402              Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
2403              and J. Reschke, Ed., "HTTP/1.1, part 3: Message Payload
2404
2405
2406
2407Fielding, et al.          Expires July 15, 2008                [Page 43]
2408
2409Internet-Draft              HTTP/1.1, Part 6                January 2008
2410
2411
2412              and Content Negotiation", draft-ietf-httpbis-p3-payload-01
2413              (work in progress), January 2008.
2414
2415   [Part4]    Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
2416              Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
2417              and J. Reschke, Ed., "HTTP/1.1, part 4: Conditional
2418              Requests", draft-ietf-httpbis-p4-conditional-01 (work in
2419              progress), January 2008.
2420
2421   [Part5]    Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
2422              Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
2423              and J. Reschke, Ed., "HTTP/1.1, part 5: Range Requests and
2424              Partial Responses", draft-ietf-httpbis-p5-range-01 (work
2425              in progress), January 2008.
2426
2427   [Part7]    Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H.,
2428              Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed.,
2429              and J. Reschke, Ed., "HTTP/1.1, part 7: Authentication",
2430              draft-ietf-httpbis-p7-auth-01 (work in progress),
2431              January 2008.
2432
2433   [RFC2047]  Moore, K., "MIME (Multipurpose Internet Mail Extensions)
2434              Part Three: Message Header Extensions for Non-ASCII Text",
2435              RFC 2047, November 1996.
2436
2437   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
2438              Requirement Levels", BCP 14, RFC 2119, March 1997.
2439
244019.2.  Informative References
2441
2442   [RFC1305]  Mills, D., "Network Time Protocol (Version 3)
2443              Specification, Implementation", RFC 1305, March 1992.
2444
2445   [RFC2616]  Fielding, R., Gettys, J., Mogul, J., Frystyk, H.,
2446              Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext
2447              Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.
2448
2449
2450Appendix A.  Compatibility with Previous Versions
2451
2452A.1.  Changes from RFC 2068
2453
2454   A case was missed in the Cache-Control model of HTTP/1.1; s-maxage
2455   was introduced to add this missing case.  (Sections 5, 15.2, 15.2.3)
2456
2457   Transfer-coding and message lengths all interact in ways that
2458   required fixing exactly when chunked encoding is used (to allow for
2459   transfer encoding that may not be self delimiting); it was important
2460
2461
2462
2463Fielding, et al.          Expires July 15, 2008                [Page 44]
2464
2465Internet-Draft              HTTP/1.1, Part 6                January 2008
2466
2467
2468   to straighten out exactly how message lengths are computed.
2469   (Section 6.2, see also [Part1], [Part3] and [Part5])
2470
2471   Proxies should be able to add Content-Length when appropriate.
2472   (Section 6.2)
2473
2474   Range request responses would become very verbose if all meta-data
2475   were always returned; by allowing the server to only send needed
2476   headers in a 206 response, this problem can be avoided.
2477   (Section 6.3)
2478
2479   The Cache-Control: max-age directive was not properly defined for
2480   responses.  (Section 15.2.3)
2481
2482   Warnings could be cached incorrectly, or not updated appropriately.
2483   (Section 2.2, 3.4, 6.2, 6.3, 15.2.3, and 15.6) Warning also needed to
2484   be a general header, as PUT or other methods may have need for it in
2485   requests.
2486
2487A.2.  Changes from RFC 2616
2488
2489   Clarify denial of service attack avoidance requirement.  (Section 11)
2490
2491
2492Appendix B.  Change Log (to be removed by RFC Editor before publication)
2493
2494B.1.  Since RFC2616
2495
2496   Extracted relevant partitions from [RFC2616].
2497
2498B.2.  Since draft-ietf-httpbis-p6-cache-00
2499
2500   Closed issues:
2501
2502   o  <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/9>: "Trailer"
2503      (<http://purl.org/NET/http-errata#trailer-hop>)
2504
2505   o  <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/12>:
2506      "Invalidation after Update or Delete"
2507      (<http://purl.org/NET/http-errata#invalidupd>)
2508
2509   o  <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/35>: "Normative
2510      and Informative references"
2511
2512   o  <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/48>: "Date
2513      reference typo"
2514
2515
2516
2517
2518
2519Fielding, et al.          Expires July 15, 2008                [Page 45]
2520
2521Internet-Draft              HTTP/1.1, Part 6                January 2008
2522
2523
2524   o  <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/49>:
2525      "Connection header text"
2526
2527   o  <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/65>:
2528      "Informative references"
2529
2530   o  <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/66>:
2531      "ISO-8859-1 Reference"
2532
2533   o  <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/86>: "Normative
2534      up-to-date references"
2535
2536   o  <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/87>: "typo in
2537      13.2.2"
2538
2539   Other changes:
2540
2541   o  Use names of RFC4234 core rules DQUOTE and HTAB (work in progress
2542      on <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/36>)
2543
2544
2545Index
2546
2547   A
2548      age  7
2549      Age header  27
2550
2551   C
2552      cache  5
2553      Cache Directives
2554         max-age  33
2555         max-age  34
2556         max-stale  33
2557         min-fresh  33
2558         must-revalidate  35
2559         no-cache  30
2560         no-store  31
2561         no-transform  36
2562         only-if-cached  35
2563         private  30
2564         proxy-revalidate  36
2565         public  30
2566         s-maxage  32
2567      Cache-Control header  28
2568      cacheable  6
2569
2570   E
2571      Expires header  37
2572
2573
2574
2575Fielding, et al.          Expires July 15, 2008                [Page 46]
2576
2577Internet-Draft              HTTP/1.1, Part 6                January 2008
2578
2579
2580      explicit expiration time  6
2581
2582   F
2583      first-hand  6
2584      fresh  7
2585      freshness lifetime  7
2586
2587   G
2588      Grammar
2589         Age  27
2590         age-value  27
2591         Cache-Control  29
2592         cache-directive  29
2593         cache-extension  29
2594         cache-request-directive  29
2595         cache-response-directive  29
2596         delta-seconds  27
2597         Expires  38
2598         extension-pragma  39
2599         Pragma  39
2600         pragma-directive  39
2601         Vary  39
2602         warn-agent  40
2603         warn-code  40
2604         warn-date  40
2605         warn-text  40
2606         Warning  40
2607         warning-value  40
2608
2609   H
2610      Headers
2611         Age  27
2612         Cache-Control  28
2613         Expires  37
2614         Pragma  38
2615         Vary  39
2616         Warning  40
2617      heuristic expiration time  7
2618
2619   M
2620      max-age
2621         Cache Directive  33
2622         Cache Directive  34
2623      max-stale
2624         Cache Directive  33
2625      min-fresh
2626         Cache Directive  33
2627      must-revalidate
2628
2629
2630
2631Fielding, et al.          Expires July 15, 2008                [Page 47]
2632
2633Internet-Draft              HTTP/1.1, Part 6                January 2008
2634
2635
2636         Cache Directive  35
2637
2638   N
2639      no-cache
2640         Cache Directive  30
2641      no-store
2642         Cache Directive  31
2643      no-transform
2644         Cache Directive  36
2645
2646   O
2647      only-if-cached
2648         Cache Directive  35
2649
2650   P
2651      Pragma header  38
2652      private
2653         Cache Directive  30
2654      proxy-revalidate
2655         Cache Directive  36
2656      public
2657         Cache Directive  30
2658
2659   S
2660      s-maxage
2661         Cache Directive  32
2662      semantically transparent  5
2663      stale  7
2664
2665   V
2666      validator  7
2667      Vary header  39
2668
2669   W
2670      Warning header  40
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687Fielding, et al.          Expires July 15, 2008                [Page 48]
2688
2689Internet-Draft              HTTP/1.1, Part 6                January 2008
2690
2691
2692Authors' Addresses
2693
2694   Roy T. Fielding (editor)
2695   Day Software
2696   23 Corporate Plaza DR, Suite 280
2697   Newport Beach, CA  92660
2698   USA
2699
2700   Phone: +1-949-706-5300
2701   Fax:   +1-949-706-5305
2702   Email: fielding@gbiv.com
2703   URI:   http://roy.gbiv.com/
2704
2705
2706   Jim Gettys
2707   One Laptop per Child
2708   21 Oak Knoll Road
2709   Carlisle, MA  01741
2710   USA
2711
2712   Email: jg@laptop.org
2713   URI:   http://www.laptop.org/
2714
2715
2716   Jeffrey C. Mogul
2717   Hewlett-Packard Company
2718   HP Labs, Large Scale Systems Group
2719   1501 Page Mill Road, MS 1177
2720   Palo Alto, CA  94304
2721   USA
2722
2723   Email: JeffMogul@acm.org
2724
2725
2726   Henrik Frystyk Nielsen
2727   Microsoft Corporation
2728   1 Microsoft Way
2729   Redmond, WA  98052
2730   USA
2731
2732   Email: henrikn@microsoft.com
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743Fielding, et al.          Expires July 15, 2008                [Page 49]
2744
2745Internet-Draft              HTTP/1.1, Part 6                January 2008
2746
2747
2748   Larry Masinter
2749   Adobe Systems, Incorporated
2750   345 Park Ave
2751   San Jose, CA  95110
2752   USA
2753
2754   Email: LMM@acm.org
2755   URI:   http://larry.masinter.net/
2756
2757
2758   Paul J. Leach
2759   Microsoft Corporation
2760   1 Microsoft Way
2761   Redmond, WA  98052
2762
2763   Email: paulle@microsoft.com
2764
2765
2766   Tim Berners-Lee
2767   World Wide Web Consortium
2768   MIT Computer Science and Artificial Intelligence Laboratory
2769   The Stata Center, Building 32
2770   32 Vassar Street
2771   Cambridge, MA  02139
2772   USA
2773
2774   Email: timbl@w3.org
2775   URI:   http://www.w3.org/People/Berners-Lee/
2776
2777
2778   Yves Lafon (editor)
2779   World Wide Web Consortium
2780   W3C / ERCIM
2781   2004, rte des Lucioles
2782   Sophia-Antipolis, AM  06902
2783   France
2784
2785   Email: ylafon@w3.org
2786   URI:   http://www.raubacapeu.net/people/yves/
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799Fielding, et al.          Expires July 15, 2008                [Page 50]
2800
2801Internet-Draft              HTTP/1.1, Part 6                January 2008
2802
2803
2804   Julian F. Reschke (editor)
2805   greenbytes GmbH
2806   Hafenweg 16
2807   Muenster, NW  48155
2808   Germany
2809
2810   Phone: +49 251 2807760
2811   Fax:   +49 251 2807761
2812   Email: julian.reschke@greenbytes.de
2813   URI:   http://greenbytes.de/tech/webdav/
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855Fielding, et al.          Expires July 15, 2008                [Page 51]
2856
2857Internet-Draft              HTTP/1.1, Part 6                January 2008
2858
2859
2860Full Copyright Statement
2861
2862   Copyright (C) The IETF Trust (2008).
2863
2864   This document is subject to the rights, licenses and restrictions
2865   contained in BCP 78, and except as set forth therein, the authors
2866   retain all their rights.
2867
2868   This document and the information contained herein are provided on an
2869   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
2870   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
2871   THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
2872   OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
2873   THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
2874   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
2875
2876
2877Intellectual Property
2878
2879   The IETF takes no position regarding the validity or scope of any
2880   Intellectual Property Rights or other rights that might be claimed to
2881   pertain to the implementation or use of the technology described in
2882   this document or the extent to which any license under such rights
2883   might or might not be available; nor does it represent that it has
2884   made any independent effort to identify any such rights.  Information
2885   on the procedures with respect to rights in RFC documents can be
2886   found in BCP 78 and BCP 79.
2887
2888   Copies of IPR disclosures made to the IETF Secretariat and any
2889   assurances of licenses to be made available, or the result of an
2890   attempt made to obtain a general license or permission for the use of
2891   such proprietary rights by implementers or users of this
2892   specification can be obtained from the IETF on-line IPR repository at
2893   http://www.ietf.org/ipr.
2894
2895   The IETF invites any interested party to bring to its attention any
2896   copyrights, patents or patent applications, or other proprietary
2897   rights that may cover technology that may be required to implement
2898   this standard.  Please address the information to the IETF at
2899   ietf-ipr@ietf.org.
2900
2901
2902Acknowledgment
2903
2904   Funding for the RFC Editor function is provided by the IETF
2905   Administrative Support Activity (IASA).
2906
2907
2908
2909
2910
2911Fielding, et al.          Expires July 15, 2008                [Page 52]
2912
Note: See TracBrowser for help on using the repository browser.