I know that Cache-Control headers can be set on the pages coming out from the web-server (as part of the response). Does anyone know how Cache-Control header should be set on the request? Should it be done via client-side scripting? If yes, how?

5 Answers 5


All right, this is an old question, but here goes:

Cache control headers mainly have meaning for responses, i.e. what the server sends to the client. Setting cache control headers on the request is usually incorrect and meaningless.

The origin server sets the cache control headers, based on what is needed for the specific content. The person or organization managing the origin server configures this.


It is possible for the client software to disobey the cache control headers in violation of the RFCs, and store content which is explicitly marked cache-control: no-store and expires: <date-in-the-past> . Such behavior is wrong, but since the client software (browser) is under the end users control, it's up to him to address this.

It is also possible for intermediary http caches (proxies) to disobey the caching headers on responses. And similarly, the individual or organization controlling the intermediary cache should fix this (and end users shouldn't permit intermediary caches which they don't trust).

Special case:

In some circumstances, clients can specify certain criteria for which responses the client is willing to accept. See RFC 2616 section 13.1.6 Client-controlled Behavior. This is rarely used, and I wouldn't be surprised if a few intermediary caches out in the real world (less common corporate firewalls / anti-virus gateways / WAN accelerators) have bugs in the handling of this.

Lastly: I always recommend Mark Nottingham's Caching Tutorial for Web Authors and Webmasters as a really good, practical introduction to HTTP caching mechanisms.


Cache-control requests are managed by the browser, there is no real reason to try and modify them. Firstly, for any URL visited, and all external requests from that page (images, scripts, styles) there is no way to control the requests.

For AJAX requests made after the page has loaded, it is possible to send specific headers (as detailed here), but it's complex and probably pointless. You don't say what your use-case is but you should probably just make your server send appropriate headers for the files in the first place.

  • my intention is to not cache confidential data being filled out in forms on the client side. I am looking for a solution for both HTTP 1.1 and 1.0 protocol (if possible). Yesterday, when i re-read the HTTP 1.1 RFC, it said that by specifying the 'no-store' option, we can attain request cache control via responses: "If sent in a response, a cache MUST NOT store any part of either this response or the request that elicited it". So, that solved my problem for HTTP 1.1 protocol, but for HTTP 1.0 there doesn't seem to be any solution because the Pragma no-cache option is only for requests.
    – Pradeep
    Jun 12, 2012 at 6:17
  • There are several ways for your server to tell the browser not to cache the current page (e.g. Cache-control: no-cache). You can also set the form to autocomplete="off" which prevents the submitted data being saved. Jun 12, 2012 at 18:18

Cache-Control in request allows client to override server's header suggestions. For example:

  1. Server sets Cache-Control: 'max-age=604800, public' but you request with

    Cache-Control: 'no-cache'

Standard browsers will make call to server for same resource, even though server suggested caching.

  1. Server sends

    Cache-Control: 'no-cache'

You may add Cache-Control: 'max-age=604800, public' in your request header to force fetch from cache before sending http request to server.

So how do you control request header? Either by tweaking browser (absurd), or in the ajax requests fired by you (common usecase).

jQuery example:

        type: 'GET',
        cache: true,
        headers: {
                'Cache-Control':'max-age=604800, public'

Request-Headers through this ajax:

Accept */*
Accept-Encoding gzip, deflate
Accept-Language en-US,en;q=0.5
Cache-Control max-age=604800, public
Host theypi.net
Origin http://localhost
Referer http://localhost/admin/test.php
User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:41.0) Gecko/20100101 Firefox/41.0

Note: If you're using CORS, you also need to allow the header you want server to accept

I use the .htaccess on server

<FilesMatch "\.(php|jpg)$">
Header set Access-Control-Allow-Origin *
Header set Access-Control-Allow-Methods: GET
Header set Access-Control-Allow-Headers: Cache-Control

I admit there might be cases when you want to alter the request headers, and it is easy enough to do for AJAX requests. I don't know any way of doing it for the "normal" click-on-link-request from the browser. Cf https://stackoverflow.com/questions/374885/can-i-change-the-headers-of-the-http-request-send-by-the-browser

But why would you alter the request headers? Are there anything like a cached request? The whole idea of constructing a request and send it to the server seems to be dynamic to me. What is it you want to achieve?

  • my intention is to instruct the browser to not cache confidential data being filled out in forms. HTTP 1.1 protocol states that cache control directives can be request or response specific. I was looking for a way to do it for requests. I found some way of doing it for HTTP 1.1 - please see my comment to DisgruntledGoat.
    – Pradeep
    Jun 12, 2012 at 6:25
  • Thanks, I understand better your intention. I'm afraid I can't really help you better anyway, but I'd like to offer a couple of points to ponder. It is all HTTP that is considered here. Of course, you'll want HTTPS or some secure transport, so your confidential data can't be snooped on its way to the server. This will also ensure (as far as I can see) that even if it is cached, it will not be readable: Even if there might be a cache header that should prevent caching, there is no guarantee that servers comply to the spec.
    – norwebian
    Jun 18, 2012 at 7:52

I set cache control through PHP server side. At the top of your page, use the following code:

    // Prevent caching
    header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
    header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past

Using a date from the past ensures that the newest version of the page will always be downloaded.

  • 1
    I guess that sets the cache-control on the responses. Not sure how to do that for requests.
    – Pradeep
    Jun 11, 2012 at 13:30
  • SK , that can get very expensive in regards to resources. Why not cache static resources?
    – Frank
    Jun 18, 2012 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.