Synthetic teaching example for a website delivery brief. Not a client result, live account test or certification.
Speed and privacy need different acceptance evidence
A supplier may add no-cache to a personalised response and describe it as “not cached”. That is an incomplete explanation: the directive permits storage subject to validation. When buying a member portal, agree what may be stored, where, for whom and for how long before discussing a faster cache hit.
| Supplied response | Header | What to review |
|---|---|---|
| Public page | public, max-age=60 | Public freshness policy only |
| Account page | no-cache | Storage still possible; review the privacy requirement |
| Account page | private, no-store | Declared storage restriction, not live proof |
| Account page | private, max-age=60 | Private storage permitted; review the contract |
Use the filled example
Download the finite Node checker and filled input. Run with Node 24 or newer; no account, API or network is used.
node checks.mjs personalised-cache-contract personalised-cache-contract.jsonThe finite rule flags account responses without no-store for storage-policy review. That is this example’s conservative requirement, not a universal rule that every account page must use the same directives. The output explicitly reports authenticationVerified false. It does not connect to a CDN or check whether an intermediary obeys the supplied policy.
A useful authorised acceptance sequence
Start with two permitted test accounts containing different fictional markers. Inspect delivered headers, cache behaviour and authentication at the actual edge and origin. Test sign-out, back navigation, expired sessions and an unprivileged request. Record the cache key and whether authorisation affects it; a policy name alone cannot prove user separation.
If a previous response was already stored, adding a new directive is not proof that all old copies disappeared. A reviewed invalidation and incident process may be required. Hiding account information with client-side code is not an access-control boundary. Keep sensitive payloads out of public test captures.
This resource requests no real account page and changes no worker, edge rule or response header. It is not a penetration test or an instruction to modify frozen pages. A production change requires separate approval and measured evidence of both correct isolation and the intended performance effect.
Primary facts and limits
MDN Cache-Control reference: Distinguishes no-cache revalidation, no-store storage restrictions and private versus shared caching.
Sources reviewed 15 October 2026. The supplied input and acceptance rules are original teaching design; check current platform versions and your actual delivery contract before implementation.