Cybersecurity glossary
What is an ETag?
Learn what the ETag HTTP header is, how strong and weak validators work, how If-None-Match drives 304 responses, and when ETags improve caching without breaking CDNs.
Definition
ETag is an HTTP response header that carries an entity tag—a validator representing a specific version of a resource—so clients and caches can issue conditional requests with If-None-Match and receive 304 Not Modified when the representation is unchanged.
Why ETag matters
Bandwidth is expensive at scale, but stale content is expensive in user trust. HTTP needs a lightweight way to ask, "Is what I already have still good?" without downloading megabytes again.
ETag answers that question. Origins attach a validator to each representation; caches and browsers echo it on the next visit. Unchanged resources return a tiny 304. Changed resources return a fresh 200 with a new tag.
How ETag works
The server computes or assigns an entity tag when it serves a representation. On later requests, the client sends If-None-Match with the stored tag. The origin compares tags and either short-circuits or replaces the body.
Origin serves resource
The response includes ETag alongside Cache-Control and optionally Last-Modified.
Cache stores representation
Browser or CDN saves the body and remembers the validator for that cache key.
Freshness expires or no-cache applies
Reuse rules require contacting the origin even though a body is already stored.
Conditional request sent
The client issues GET with If-None-Match: "<etag>".
Server compares validators
Matching strong or weak rules yield 304; mismatch yields 200 with a new ETag.
Cache updates metadata
304 refreshes freshness headers; 200 replaces the stored body and tag.
ETag concepts
Strong ETag
Indicates byte-identical content. Required for certain range and If-Match write preconditions.
Weak ETag
Prefixed with W/. Means semantically equivalent content; common for compressed variants.
If-None-Match
Client header for validation GETs. Match produces 304 Not Modified.
If-Match
Write precondition. Server applies PUT/PATCH only when the ETag still matches.
304 Not Modified
Success response with no body when the validator matches the current resource.
Opaque generation
Tags should be opaque hashes or version IDs, not guessable session data.
ETag behavior by scenario
| Scenario | ETag role | Note |
|---|---|---|
| Immutable hashed asset | Optional; long max-age may skip revalidation | Content-addressed URLs reduce need for validators |
| HTML that changes often | Enables cheap revalidation after short max-age | Pair with Cache-Control no-cache or short TTL |
| REST API resource | Supports If-Match optimistic locking on updates | Strong tags preferred for concurrency control |
| Gzip and Brotli variants | Often weak per representation | Vary: Accept-Encoding must key caches correctly |
| Personalized JSON | Risky if tag encodes user identity | Prefer private, no-store over shared validator reuse |
ETag checklist
- Generate ETags deterministically per representation, not per request noise.
- Use strong ETags when APIs rely on If-Match for safe concurrent updates.
- Ensure CDNs forward If-None-Match to origin and return 304 bodies correctly.
- Align ETag changes with deploys; bump tags when representations change.
- Combine ETag with Cache-Control rather than relying on validators alone.
- Set Vary when content negotiation produces different bodies for one URL.
- Avoid user-specific ETags on responses that shared caches might store.
- Test 304 paths in synthetic monitoring, not only full 200 downloads.
Limits and pitfalls
ETags do not fix incorrect cache keys. If two users share a cache entry because Vary is missing, revalidating with ETag still confirms the wrong object is current—it does not prove the object is correct for both users.
Some clusters generate different ETags per node from inode or mtime metadata, causing constant cache misses. Centralize tag generation on content hash or version numbers instead.
The practical takeaway
ETag gives HTTP a precise validator for "has this representation changed?" It powers efficient revalidation, saves bandwidth on 304 responses, and supports safe concurrent writes through If-Match.
Emit stable, opaque tags per representation, wire them through your CDN, and treat ETag as part of your caching contract—not an automatic performance win if every edge returns a different value.
Related security terms
Cache-Control
Directives that decide when caches must revalidate using validators such as ETag.
Cache Revalidation
The workflow where caches send If-None-Match to confirm a stored copy is still valid.
Conditional Request
Requests that carry If-None-Match or If-Match preconditions tied to ETag values.
Cache Key
Identifies which cached representation an ETag belongs to at the CDN or browser.
Frequently asked questions
What is an ETag in simple terms?
An ETag is a version fingerprint the server puts on a response. Later, the client or cache sends that fingerprint back. If the file has not changed, the server can reply with 304 and skip resending the body.
What is the difference between a strong and weak ETag?
A strong ETag (no W/ prefix) means byte-for-byte equality. A weak ETag (W/"...") means semantic equivalence. Strong tags are required for some range requests and optimistic concurrency with If-Match.
How does If-None-Match relate to ETag?
If-None-Match carries one or more ETag values on a follow-up GET or HEAD. If any value matches the current resource, the server returns 304 Not Modified instead of the full body.
Do ETags work with CDNs?
Yes, when the CDN preserves and forwards validators correctly. Misconfigured CDNs that strip ETag or vary it per edge node can cause unnecessary 200 responses or confusing revalidation.
Can ETags leak information?
Predictable or user-specific ETags can reveal whether content changed or fingerprint individual sessions. Prefer opaque, stable-per-representation tags and avoid embedding private identifiers.
Should I use ETag or Last-Modified?
Either can validate caches. ETags often detect changes more precisely than one-second Last-Modified granularity. Many origins emit both; caches prefer ETag when present.
References
Explore authoritative guidance and frameworks related to etag.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.