This week in caching: private browser cache vs shared CDN cache

This week in caching: private browser cache vs shared CDN cache

The header nuance that causes the most cache bugs:

— Cache-Control: private means only the user's browser may store it — correct for logged-in dashboards. A CDN must skip it.
— public opens it to shared caches (CDN, proxies) — correct for anonymous pages.
— The killer: s-maxage overrides max-age for shared caches only. So you can tell the CDN 'cache 1 hour' while telling browsers 'cache 1 minute' — long edge life, fresh-ish clients, no header conflict.

Classic outage: serving a logged-in page as public and leaking one user's cart to everyone behind the CDN. Always pair user-specific responses with private AND a Vary on the auth cookie.

Bookmark: MDN's Cache-Control reference — keep the private/public/s-maxage section open while you debug.