Cache-Control private and public

The private and public directives control whether a response may be stored in a private cache or shared cache.

Use private for user-specific responses and public only when shared reuse is safe. Neither directive encrypts a response or overrides a cache key that varies incorrectly.

httpcacheheadersecurity

Reference (http)

Cache-Control: private, max-age=60
Cache-Control: public, max-age=300

Use private for user-specific responses and public only when shared reuse is safe. Neither directive encrypts a response or overrides a cache key that varies incorrectly.

Common mistakes

Marking personalized content public, or assuming private means the browser cannot store the response.

Cache-Control Vary Header ETag and Conditional Requests

Sources

MDN HTTP Reference
OWASP HTTP Headers Cheat Sheet
IANA HTTP Field Name Registry
RFC 9111: Cache-Control
MDN Cache-Control