Network Working Group R. Fielding Request for Comments: 2616 ...

improve privacy in some cases, we caution that it is NOT in anyway a reliable or sufficient mechanism for ensuring privacy. Inparticular, malicious or compromised caches might not recognize orobey this directive, and communications networks might bevulnerable to eavesdropping.14.9.3 Modifications of the Basic Expiration MechanismThe expiration time of an entity MAY be specified by the originserver using the Expires header (see section 14.21). Alternatively,it MAY be specified using the max-age directive in a response. Whenthe max-age cache-control directive is present in a cached response,the response is stale if its current age is greater than the agevalue given (in seconds) at the time of a new request for thatresource. The max-age directive on a response implies that theresponse is cacheable (i.e., "public") unless some other, morerestrictive cache directive is also present.If a response includes both an Expires header and a max-agedirective, the max-age directive overrides the Expires header, evenif the Expires header is more restrictive. This rule allows an originserver to provide, for a given response, a longer expiration time toan HTTP/1.1 (or later) cache than to an HTTP/1.0 cache. This might beuseful if certain HTTP/1.0 caches improperly calculate ages orexpiration times, perhaps due to desynchronized clocks.Many HTTP/1.0 cache implementations will treat an Expires value thatis less than or equal to the response Date value as being equivalentto the Cache-Control response directive "no-cache". If an HTTP/1.1cache receives such a response, and the response does not include aCache-Control header field, it SHOULD consider the response to benon-cacheable in order to retain compatibility with HTTP/1.0 servers.Note: An origin server might wish to use a relatively new HTTPcache control feature, such as the "private" directive, on anetwork including older caches that do not understand thatfeature. The origin server will need to combine the new featurewith an Expires field whose value is less than or equal to theDate value. This will prevent older caches from improperlycaching the response.Fielding, et al. Standards Track [Page 111]RFC 2616 HTTP/1.1 June 1999