https://stackonward.com/tags/etag/Recent content in ETag on StackOnwardHugoen-USFri, 11 Sep 2026 04:20:00 +0800https://stackonward.com/posts/static-asset-cache-control/Fri, 11 Sep 2026 04:20:00 +0800https://stackonward.com/posts/static-asset-cache-control/<p>Cache-Control for static assets cannot be one header copied onto every path. Fingerprinted CSS, JavaScript, and fonts can stay cached for a year. HTML has to revalidate so it can pick up new URLs. Images that keep the same filename can stay cached only for as long as outdated bytes are acceptable. Responses that carry account or payment data must not enter a shared cache.</p> <figure> <img src="https://stackonward.com/images/posts/static-asset-cache-control/en/cache-policy-map.svg" alt="Decision map from public versus sensitive responses to no-store, one-year immutable cache, or short cache and revalidation" loading="lazy" decoding="async"> <figcaption>Cache lifetime follows whether the URL changes with the content, whether the response is public, and how long stale copies are allowed to remain.</figcaption> </figure> <h2 id="cache-control-for-static-assets-starts-from-whether-the-url-changes">Cache-Control for static assets starts from whether the URL changes</h2> <div class="table-responsive" role="region" aria-label="Scrollable table" tabindex="0"> <table> <thead> <tr> <th>Resource</th> <th>When the URL changes</th> <th>Usual policy</th> <th>Publish requirement</th> </tr> </thead> <tbody> <tr> <td>HTML</td> <td>The address stays; the document changes</td> <td><code>no-cache</code> or a short <code>max-age</code></td> <td>Revalidate or expire in time for the next release</td> </tr> <tr> <td>Fingerprinted CSS, JS, and fonts</td> <td>The filename changes with the bytes</td> <td><code>public, max-age=31536000, immutable</code></td> <td>HTML must reference the new URL</td> </tr> <tr> <td>Unversioned images and PDFs</td> <td>The same address may be overwritten</td> <td>Short cache plus ETag</td> <td>Purge that URL or change the URL after a replace</td> </tr> <tr> <td>Public API responses</td> <td>Business semantics decide</td> <td>Explicit <code>public</code> or <code>private</code>, <code>s-maxage</code>, and <code>Vary</code></td> <td>The cache key must cover every response difference</td> </tr> <tr> <td>Sensitive or one-time responses</td> <td>Reuse is not allowed</td> <td><code>no-store</code></td> <td>The CDN must not cache them either</td> </tr> </tbody> </table> </div> <p><code>app.4f81c9a2.js</code> can be treated as immutable only because a content change produces a new filename. A directory named <code>/assets/</code> does not prove that every file inside it is immutable.</p>