Cybersecurity glossary
What is Cache Revalidation?
Learn how cache revalidation lets browsers and CDNs confirm stored responses are still current using validators and conditional requests, and when revalidation protects correctness versus hurting performance.
Definition
Cache revalidation is the process where an HTTP cache checks with the origin whether a stored response remains usable, typically by sending a conditional request with validators such as ETag or Last-Modified and receiving either a 304 Not Modified or a full replacement response.
Why cache revalidation matters
Pure time-based freshness is simple but brittle. Deploy a fix and clients may keep old JavaScript until max-age expires. Cache revalidation adds a lightweight checkpoint: caches can reuse bytes when the origin agrees they are still valid, and refresh when they are not.
For security-sensitive teams, revalidation is also a policy lever. no-cache and must-revalidate express that storage may occur but blind reuse may not. That nuance matters for semi-dynamic APIs and HTML that changes with authorization state.
How revalidation works
When a cache decides validation is required, it forwards a conditional request carrying validators from the stored entry. The origin compares them to the current resource and responds with either 304 Not Modified or a new 200 (or error) with updated headers and body.
Freshness check fails or policy requires it
max-age elapsed, must-revalidate applies, or the client requested validation.
Cache builds a conditional request
If-None-Match and/or If-Modified-Since carry validators from the stored response.
Origin evaluates validators
The server compares ETag or modification time against the live resource.
304 or full response
Unchanged resources return 304; changes return a new representation and update cache metadata.
Cache updates or extends use
On 304, the entry is refreshed administratively; on 200, body and headers replace the slot.
Revalidation triggers and tools
ETag / If-None-Match
Strong or weak entity tags offer precise change detection for APIs and assets.
Last-Modified / If-Modified-Since
Time-based validators; simple but coarse when resources change sub-second.
Cache-Control: no-cache
Forces validation before reuse even if the entry is still within max-age.
must-revalidate
Once stale, caches must not serve without successful revalidation.
stale-while-revalidate
Serve stale immediately while fetching a fresh copy asynchronously.
CDN origin shield
Edge clusters consolidate revalidation to reduce origin load.
Revalidation strategies by content
| Content type | Typical strategy | Security note |
|---|---|---|
| Versioned static bundles | Long max-age; revalidation rare | Prefer immutable URLs over constant ETag checks |
| Semi-static JSON config | Short max-age + ETag | Ensure ETag changes when auth-sensitive fields change |
| Authenticated HTML | no-store or private + revalidate | Shared CDNs should not hold these entries |
| Public HTML with frequent edits | no-cache or short SWR | Watch poisoned error pages during revalidation storms |
| Large media files | ETag validation to save bandwidth | Range requests interact with validators; test thoroughly |
Operations checklist
- Emit stable ETags for cacheable API responses that may change without URL changes.
- Use must-revalidate when serving stale content would be misleading or unsafe.
- Do not confuse no-cache (revalidate) with no-store (do not keep).
- Monitor 304 ratio at the origin; sudden drops may indicate deployment or validator bugs.
- Ensure personalized responses either skip shared caches or fail revalidation per user.
- Test CDN behavior: some edges transform or strip validators unless configured.
- Pair revalidation policy with accurate Vary when representations differ by negotiation.
- After security incidents, purge affected keys; revalidation alone does not remove poisoned bodies.
Limits and pitfalls
Revalidation still costs latency and origin CPU. Aggressive no-cache on high-traffic assets can negate caching benefits entirely. Weak ETags that ignore meaningful body changes can produce 304 responses when content actually shifted in security-relevant ways.
stale-while-revalidate improves UX but is inappropriate for authorization gates, financial balances, or feature flags that must flip atomically. Serving stale while refreshing means some users see old behavior during the window.
The practical takeaway
Cache Revalidation lets caches ask the origin “is my copy still OK?” instead of always refetching or always guessing from a clock. Validators and conditional requests make that conversation efficient.
Use revalidation where freshness matters but full downloads do not, keep validators honest when responses carry security-sensitive fields, and reserve hard no-store for data that should never sit in a shared slot waiting for a 304.
Related security terms
Conditional Request
The mechanism caches use to ask the origin whether a stored copy is still valid.
Cache-Control
Directives such as no-cache and must-revalidate that trigger revalidation behavior.
Cache Key
Identifies which stored entry is being revalidated for a given request.
HTTPS
Protects revalidation traffic from tampering on the network path.
Frequently asked questions
What is cache revalidation in simple terms?
Instead of downloading the whole file again, the cache asks the server whether its saved copy is still good. If yes, the server says so with a short 304 response. If not, it sends a new full response.
When does a cache revalidate?
When the stored response is stale, when Cache-Control requires it (for example no-cache or must-revalidate), or when the client sends directives that force validation before reuse.
What headers enable revalidation?
ETag and Last-Modified are validators on the stored response. The cache sends If-None-Match or If-Modified-Since on the follow-up request to compare against the origin.
Is revalidation the same as a cache miss?
Not exactly. A miss fetches a full new representation. Revalidation may still be a network round trip but often returns 304 with an empty body, saving bandwidth while confirming freshness.
Does revalidation prevent cache poisoning?
It helps ensure content is still current but does not fix bad keying. If the wrong object was stored under a key, revalidation confirms that wrong object is still the origin answer—not that it is safe for every user.
What is stale-while-revalidate?
An extension pattern where caches may serve a stale copy immediately while refreshing in the background. It improves perceived speed but must be used only when brief staleness is acceptable.
References
Explore authoritative guidance and frameworks related to cache revalidation.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.