8.5K
DECache Control is not something browser sends first. It is a response header sent by the server along with the API response. Server is basically telling browser or CDN how to treat that data.
Example
User hits GET /api/profile
Server sends profile JSON + Cache Control header
Now what happens next depends on the type of Cache Control 👇
1️⃣ no-cache
This does NOT mean do not cache.
It means you can store the response, but before using it again you must check with the server if it is still valid.
So browser keeps a copy, but every time before reuse it revalidates.
Perfect for dashboards or data that changes often but not every second.
2️⃣ no-store
This means do not store this response anywhere.
Not in browser memory. Not on disk. Not in CDN.
Used for login response, OTP verification, bank details or anything sensitive.
Every single request must hit the server again. No shortcuts.
3️⃣ private
This means browser can store it, but shared caches like CDN cannot.
Very important for authenticated APIs like user profile.
It ensures one user’s data is not cached and accidentally served to another user.
🚨Real production mistake 🚨
If you accidentally send public with max-age on an authenticated endpoint, CDN may cache it based on URL.
Now imagine
User A hits /api/profile
CDN caches it
User B hits same URL
CDN serves User A’s data
Boom. Data leak !!!!!
Like, Share and Follow for more !!
And save this reel for later :)
#apis #backend #api #systemdesign
@deepchandoa.ai
