Summary

  • HTTP freshness is a stored-response reuse rule, not a current origin or user-authorization decision.
  • Sensitive delivery needs a receipt joining cache state to the authority that still permits disclosure.

Imagine an origin removes a user's entitlement and withdraws a sensitive representation. A shared cache nevertheless keeps serving its stored response because its freshness lifetime has not ended. Every cache hit is logged as if the origin approved a new disclosure. The cache may be following its metadata exactly while the audit claim is false.

RFC 9111 defines freshness through age, freshness lifetime and request conditions. A fresh stored response can normally be reused without validation. That is valuable delegation: it reduces latency and origin load. But the delegation concerns reuse of a representation under HTTP metadata. It is not evidence that an account, entitlement or disclosure policy remains unchanged.

Authenticated requests receive special treatment. RFC 9111 restricts storage unless response directives permit it. Those directives still describe cache behavior; they do not identify the present principal or repeat an application authorization decision. A cache key that omits relevant authorization context can therefore turn a technically reusable response into an incorrectly shared one.

Validation narrows the gap. A conditional request can carry an ETag or modification date, and a 304 Not Modified response can refresh stored metadata. Yet content equality and disclosure authority are different propositions. The bytes may be unchanged while the set of people allowed to receive them has changed.

Invalidation also has limits. Responses to unsafe methods can invalidate related stored responses, but an entitlement change elsewhere in an application is not automatically an HTTP invalidation event at every intermediary. RFC 5861 further permits bounded stale serving through stale-while-revalidate and stale-if-error. Those controls can improve availability while widening the interval between origin state and delivered state.

The durable evidence object is a cache-disclosure receipt: cache key and partition, stored-response timestamp, calculated age and freshness lifetime, relevant request and authorization context, response directives, validator and revalidation result, any stale allowance, origin policy version, delivery time and the component that decided to serve. It states what the cache knew and which authority justified disclosure then.