Network Working Group R. Fielding Request for Comments: 2616 ...

- DELETE- POSTIn order to prevent denial of service attacks, an invalidation basedon the URI in a Location or Content-Location header MUST only beperformed if the host part is the same as in the Request-URI.A cache that passes through requests for methods it does notunderstand SHOULD invalidate any entities referred to by theRequest-URI.13.11 Write-Through MandatoryAll methods that might be expected to cause modifications to theorigin server's resources MUST be written through to the originserver. This currently includes all methods except for GET and HEAD.A cache MUST NOT reply to such a request from a client before havingtransmitted the request to the inbound server, and having received acorresponding response from the inbound server. This does not preventa proxy cache from sending a 100 (Continue) response before theinbound server has sent its final reply.The alternative (known as "write-back" or "copy-back" caching) is notallowed in HTTP/1.1, due to the difficulty of providing consistentupdates and the problems arising from server, cache, or networkfailure prior to write-back.Fielding, et al. Standards Track [Page 98]RFC 2616 HTTP/1.1 June 199913.12 Cache ReplacementIf a new cacheable (see sections 14.9.2, 13.2.5, 13.2.6 and 13.8)response is received from a resource while any existing responses forthe same resource are cached, the cache SHOULD use the new responseto reply to the current request. It MAY insert it into cache storageand MAY, if it meets all other requirements, use it to respond to anyfuture requests that would previously have caused the old response tobe returned. If it inserts the new response into cache storage therules in section 13.5.3 apply.Note: a new response that has an older Date header value thanexisting cached responses is not cacheable.