Network Working Group R. Fielding Request for Comments: 2616 ...

If the no-cache directive does not specify a field-name, then acache MUST NOT use the response to satisfy a subsequent requestwithout successful revalidation with the origin server. Thisallows an origin server to prevent caching even by caches thathave been configured to return stale responses to client requests.If the no-cache directive does specify one or more field-names,then a cache MAY use the response to satisfy a subsequent request,subject to any other restrictions on caching. However, thespecified field-name(s) MUST NOT be sent in the response to asubsequent request without successful revalidation with the originserver. This allows an origin server to prevent the re-use ofcertain header fields in a response, while still allowing cachingof the rest of the response.Note: Most HTTP/1.0 caches will not recognize or obey thisdirective.14.9.2 What May be Stored by Cachesno-storeThe purpose of the no-store directive is to prevent theinadvertent release or retention of sensitive information (forexample, on backup tapes). The no-store directive applies to theentire message, and MAY be sent either in a response or in arequest. If sent in a request, a cache MUST NOT store any part ofeither this request or any response to it. If sent in a response,a cache MUST NOT store any part of either this response or therequest that elicited it. This directive applies to both nonsharedand shared caches. "MUST NOT store" in this context meansthat the cache MUST NOT intentionally store the information innon-volatile storage, and MUST make a best-effort attempt toremove the information from volatile storage as promptly aspossible after forwarding it.Even when this directive is associated with a response, usersmight explicitly store such a response outside of the cachingsystem (e.g., with a "Save As" dialog). History buffers MAY storesuch responses as part of their normal operation.Fielding, et al. Standards Track [Page 110]RFC 2616 HTTP/1.1 June 1999The purpose of this directive is to meet the stated requirementsof certain users and service authors who are concerned aboutaccidental releases of information via unanticipated accesses tocache data structures. While the use of this directive might