Network Working Group R. Fielding Request for Comments: 2616 ...

must-revalidateBecause a cache MAY be configured to ignore a server's specifiedexpiration time, and because a client request MAY include a maxstaledirective (which has a similar effect), the protocol alsoincludes a mechanism for the origin server to require revalidationof a cache entry on any subsequent use. When the must-revalidatedirective is present in a response received by a cache, that cacheMUST NOT use the entry after it becomes stale to respond to aFielding, et al. Standards Track [Page 114]RFC 2616 HTTP/1.1 June 1999subsequent request without first revalidating it with the originserver. (I.e., the cache MUST do an end-to-end revalidation everytime, if, based solely on the origin server's Expires or max-agevalue, the cached response is stale.)The must-revalidate directive is necessary to support reliableoperation for certain protocol features. In all circumstances anHTTP/1.1 cache MUST obey the must-revalidate directive; inparticular, if the cache cannot reach the origin server for anyreason, it MUST generate a 504 (Gateway Timeout) response.Servers SHOULD send the must-revalidate directive if and only iffailure to revalidate a request on the entity could result inincorrect operation, such as a silently unexecuted financialtransaction. Recipients MUST NOT take any automated action thatviolates this directive, and MUST NOT automatically provide anunvalidated copy of the entity if revalidation fails.Although this is not recommended, user agents operating undersevere connectivity constraints MAY violate this directive but, ifso, MUST explicitly warn the user that an unvalidated response hasbeen provided. The warning MUST be provided on each unvalidatedaccess, and SHOULD require explicit user confirmation.proxy-revalidateThe proxy-revalidate directive has the same meaning as the mustrevalidatedirective, except that it does not apply to non-shareduser agent caches. It can be used on a response to anauthenticated request to permit the user's cache to store andlater return the response without needing to revalidate it (sinceit has already been authenticated once by that user), while stillrequiring proxies that service many users to revalidate each time(in order to make sure that each user has been authenticated).Note that such authenticated responses also need the public cachecontrol directive in order to allow them to be cached at all.