title: Ideal HTTP cache control headers for different types of resources
body: <p>I want to find a minimal set of headers, that work with "all" caches and browsers (also when using <strong>HTTPS</strong>!)</p>
  
  <p>On my web site, I'll have three kinds of resources:</p>
  
  <h3>(1) Forever cacheable (public / equal for all users)</h3>
  
  <p><sup>Example: 0A470E87CC58EE133616F402B5DDFE1C.cache.html (<a href="http://code.google.com/webtoolkit/doc/latest/FAQ_DebuggingAndCompiling.html#Compiling_for_Web_Mode" rel="noreferrer">auto generated by GWT</a>)</sup> </p>
  
  <ul>
  <li><p>These files are automatically assigned a new name, when they change content (based on the MD5).</p></li>
  <li><p>They should get cached as much as possible, even when using HTTPS (so I assume, I should set <code>Cache-Control: public</code>, especially for Firefox?)</p></li>
  <li><p>They shouldn't require the client to make a round-trip to the server to validate, if the content has changed.</p></li>
  </ul>
  
  <h3>(2) Changing occasionally (public / equal for all users)</h3>
  
  <p><sup>Examples: index.html, mymodule.nocache.js</sup></p>
  
  <ul>
  <li><p>These files change their content without changing the URL, when a new version of the site is deployed.</p></li>
  <li><p>They can be cached, but probably need a round-trip to be revalidated every time.</p></li>
  </ul>
  
  <h3>(3) Individual for each request (private / user specific)</h3>
  
  <p><sup>Example: JSON responses</sup></p>
  
  <ul>
  <li>These resources should never be cached unencrypted to disk under no circumstances. (Except maybe I'll have a few specific requests that could be cached.)</li>
  </ul>
  
  <hr>
  
  <p>I have a general idea on which headers I would probably use for each type, but there's always something I could be missing.</p>