Cache-Control, ETag, 304 — how do you refresh data?

Cache-Control sets the rules for storage and freshness. An ETag identifies a version of a representation; the client can send If-None-Match, and the server can answer 304 when the version hasn't changed.

Cache-Control: private, no-cache
ETag: "profile-v3"

To be precise: no-cache allows storing the response but requires validation before reuse. No-store forbids storing it at all. Private limits caching to the private client; public allows a shared cache.

Pitfall: personalised responses must not accidentally end up in a shared cache for everyone. The browser cache, a CDN and a framework's data cache are different layers.