Private Vs Public

title: "Private vs Public Cache — Who Can Store Your API Responses" description: "Private cache stores responses in the browser only while public cache allows intermediate proxies and CDNs to store responses for shared access." date: 2026-06-28 lastmod: 2026-06-28 weight: 17 tags: [apis, caching] }

Private cache directives restrict storage to the client browser only. Public cache allows any intermediate proxy or CDN to store and reuse the response across clients.

What You'll Learn

• Private vs public cache semantics
• When to use each directive
• Cache scope and security implications

Why It Matters

Using private when you need public reduces cache efficiency. Using public for user-specific data leaks information between users.

Cache Scope

flowchart LR
    subgraph Public
        CDN[CDN Cache]
        Proxy[Proxy Cache]
    end
    subgraph Private
        Browser[Browser Cache]
    end
    Browser --> Proxy
    Proxy --> CDN
    CDN --> O[Origin Server]

Code Examples

# Public: cacheable by everyone
@app.route('/api/products')
def list_products():
    # All users see the same products
    return jsonify(get_products()), 200, {
        'Cache-Control': 'public, max-age=3600'
    }

# Private: browser only, never proxy/CDN
@app.route('/api/users/me')
def get_current_user():
    # User-specific data
    return jsonify({'id': current_user.id, 'email': current_user.email}), 200, {
        'Cache-Control': 'private, max-age=60'
    }

# No-store: never cache anywhere
@app.route('/api/auth/login')
def login():
    return jsonify({'token': generate_token()}), 200, {
        'Cache-Control': 'no-store'
    }

# Public with s-maxage override
@app.route('/api/public-data')
def public_data():
    # CDN caches 1 hour, browser caches 5 minutes
    return jsonify(public_data()), 200, {
        'Cache-Control': 'public, max-age=300, s-maxage=3600'
    }

// Express private cache example
app.get('/api/account/balance', (req, res) => {
  const balance = getBalance(req.user.id);
  res.set('Cache-Control', 'private, max-age=30');  // 30s browser-only
  res.json({ balance });
});

app.get('/api/exchange-rates', (req, res) => {
  res.set('Cache-Control', 'public, max-age=3600');
  res.json(getRates());
});

Common Mistakes

1. Public Cache on Auth Endpoints

Auth tokens and user data leak to other users.

2. Private Cache on Public Data

Reduces CDN efficiency for globally shared content.

3. Forgetting Vary: Authorization with Private

Even with private, add Vary: Authorization for correctness.

4. Using Private When no-store Is Needed

Private still caches. no-store prevents all caching.

5. Public Cache with User-Specific Query Params

Use Vary or per-user cache keys instead of public.

Practice Questions

1. What is the difference between private and public?
2. Where is private cache stored?
3. Where is public cache stored?
4. Should auth responses be private, public, or no-store?
5. How does public cache affect CDN behavior?

Answers:

1. Private is browser-only; public includes proxies and CDNs.
2. In the client browser's local cache.
3. In intermediate proxies, CDNs, and browsers.
4. no-store for login; private for authenticated user data.
5. CDNs cache public responses at edge locations for all users.

Challenge: Audit your API endpoints. Classify each as public, private, or no-store and add appropriate Cache-Control headers.

FAQ