Cache headers served by Google, Facebook, AWS in 2016

Recently I realized that our SPA app was misbehaving: our JS and CSS had cache-busting digests in the URLs, but browsers were caching the underlying index.html.

What do the big apps send?

	Cache-Control	Expires	Pragma
AWS management console	no-cache, no-store, must-revalidate	-1	no-cache
Facebook	private, no-cache, no-store, must-revalidate	Sat, 01 Jan 2000 00:00:00 GMT	no-cache
Google (the search engine)	private, max-age=0	-1
gmail	no-cache, no-store, max-age=0, must-revalidate	Mon, 01 Jan 1990 00:00:00 GMT	no-cache
Google Drive	no-cache, no-store, max-age=0, must-revalidate	Mon, 01 Jan 1990 00:00:00 GMT	no-cache
Intercom	max-age=0, private, must-revalidate
LinkedIn	no-cache, no-store	Thu, 01 Jan 1970 00:00:00 GMT	no-cache

Implementation in nginx

In the end, I just went with nginx's default:

expires epoch;

That produced

Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:01 GMT

:D