HTTP caching with ETags and conditional requests

What it is

RFC 9110 defines the ETag header as an opaque validator for a specific representation of a resource. A strong ETag changes whenever the representation bytes change; a weak one (W/"…") may stay the same across semantically equivalent variants. Clients send If-None-Match on GET to receive 304 Not Modified when the validator still matches, and If-Match on PUT or PATCH so that the server rejects the write with 412 Precondition Failed if the resource changed in between. RFC 9111 defines Cache-Control directives such as max-age, no-store, must-revalidate and public/private.

Why it matters

Conditional GETs save bandwidth and let clients poll cheaply. If-Match turns optimistic concurrency into an HTTP-level contract: two agents editing the same article cannot silently overwrite each other.

How to apply

• Emit an ETag on every cacheable GET; keep different representations (JSON, Markdown, HTML) from sharing one strong tag.
• Answer If-None-Match matches with 304 and the same cache headers, with no body.
• Require If-Match on state-changing updates and reply 428 when it is missing.
• Mark authenticated or per-user responses private or no-store.

Pitfalls

Proxies that compress responses share the origin's ETag across encodings; weak tags are the honest choice there. no-cache still allows storing; no-store forbids it. Vary must list every request header that changes the response.