Matching: pick the Cache-Control for each response Intermediate

Cache-Control decides who may store a response (nobody, only the browser, or the CDN too) and how stale it may get. Drag a header set onto each response.

• Each explanation cites RFC 9111 (caching), RFC 9110 (status codes, conditional requests), RFC 5861 (stale-while-revalidate) or RFC 8246 (immutable).
• The most commonly confused pairs: no-cache vs no-store, private vs public, and no-cache vs must-revalidate when the request carries Authorization.

Matching

Which Cache-Control should this response send?

Eight responses from an online shop that sits behind a CDN. Drag the header set that fits each one. Cards can be used more than once.

Tip: first ask who may store it (nobody, only the browser, or the CDN too), then how stale it may get before someone must check with the origin.

Tap Choose answer on each case. On a computer you can drag a card below onto a case.

public, max-age=31536000, immutableno-cache + ETagno-storemax-age=0, must-revalidateprivate, max-age=60public, s-maxage=60, stale-while-revalidate=30

Solved 0/8 · 0 mistakes

1The build emits app.3f9a1c.js; the hash in the name changes whenever the content changes. Old names are never reused.

GET /assets/app.3f9a1c.js

Choose answer ▾

2GET /account shows the logged-in shopper's name, address and recent orders. The session is a cookie. Data up to 1 minute old is fine, and the back button should be instant.

Cookie: sid=9f3c...

Choose answer ▾

3GET /statements/2026-09.pdf returns a payment statement with card digits and addresses. Shoppers often open it on shared office computers.

Choose answer ▾

4GET /products?category=shoes is the same for every visitor and is fetched 2,000 times per second at peak (illustrative). Prices and stock may lag by about a minute.

Vary: Accept-Encoding

Choose answer ▾

5GET / returns the HTML shell that references app.3f9a1c.js. After each deploy, users must load the new bundle names within seconds.

<script src="/assets/app.3f9a1c.js"></script>

Choose answer ▾

6GET /b2b/price/42 returns the contract price for the caller's company. Requests carry Authorization: Bearer ...; the response is 40 KB and must never be shown without the origin confirming it is current.

Authorization: Bearer eyJ... (company 17)

Choose answer ▾

7GET /r/ab3 returns 302 to a campaign page. The target may be fixed or revoked within a minute, and the origin counts each visitor's first click.

HTTP/1.1 302 Found
Location: https://shop.example/sale

Choose answer ▾

8An internal API gateway (a shared cache) sits in front of GET /reports/daily-sales (2 MB). Every caller sends the same service token in Authorization. The report must never be served stale, but the gateway should keep a copy so unchanged reports cost only a 304 from the backend.

Authorization: Bearer svc-reporting
ETag: "r-2026-10-28-1"

Choose answer ▾

For the mechanism behind each card (freshness, validation, Vary, 304), read HTTP caching. For redirect caching, read URL shortener.