Network Working Group R. Fielding Request for Comments: 2616 ...

Unless specifically constrained by a cache-control (section 14.9)directive, a caching system MAY always store a successful response(see section 13.8) as a cache entry, MAY return it without validationif it is fresh, and MAY return it after successful validation. Ifthere is neither a cache validator nor an explicit expiration timeassociated with a response, we do not expect it to be cached, butcertain caches MAY violate this expectation (for example, when littleor no network connectivity is available). A client can usually detectthat such a response was taken from a cache by comparing the Dateheader to the current time.Note: some HTTP/1.0 caches are known to violate this expectationwithout providing any Warning.However, in some cases it might be inappropriate for a cache toretain an entity, or to return it in response to a subsequentrequest. This might be because absolute semantic transparency isdeemed necessary by the service author, or because of security orprivacy considerations. Certain cache-control directives aretherefore provided so that the server can indicate that certainresource entities, or portions thereof, are not to be cachedregardless of other considerations.Note that section 14.8 normally prevents a shared cache from savingand returning a response to a previous request if that requestincluded an Authorization header.A response received with a status code of 200, 203, 206, 300, 301 or410 MAY be stored by a cache and used in reply to a subsequentrequest, subject to the expiration mechanism, unless a cache-controldirective prohibits caching. However, a cache that does not supportthe Range and Content-Range headers MUST NOT cache 206 (PartialContent) responses.A response received with any other status code (e.g. status codes 302and 307) MUST NOT be returned in a reply to a subsequent requestunless there are cache-control directives or another header(s) thatexplicitly allow it. For example, these include the following: anExpires header (section 14.21); a "max-age", "s-maxage", "mustrevalidate","proxy-revalidate", "public" or "private" cache-controldirective (section 14.9).Fielding, et al. Standards Track [Page 91]