I have yet to see a `Cache-Policy` header; assuming `Cache-Control`. Now: do you have a good reason for must-revalidate, or is it just "it was on SO, stick it

I have yet to see a `Cache-Policy` header; assuming `Cache-Control`. Now: do you have a good reason for must-revalidate, or is it just "it was on SO, stick it in there"? Without further headers, this does nothing and wastes 16 bytes per request ;) Conditional requests can indeed be mixed with expiration; consider looking at Last-Modified while at it. For largish data, byte-serving is not quite caching, but still comes in handy. Last but not least, Cache-Control: immutable and/or content hash are still viable - but especially for content you do expect to be around Forever(tm). Check also the Age header, and Expires - but that's been mostly superseded by clever tricks with 304s and Cache-Control.