Is it OK to set "Cache-Control: public" when sending “304 Not Modified” for images stored in the datastore

After asking a question about sending “304 Not Modified” for images stored in the in the Google App Engine datastore, I now have a question about Cache-Control.

My app now sends Last-Modified and Etag, but by default GAE alsto sends Cache-Control: no-cache. According to this page:

The “no-cache” directive, according to the RFC, tells the browser that it should revalidate with the server before serving the page from the cache. [...] In practice, IE and Firefox have started treating the no-cache directive as if it instructs the browser not to even cache the page.

As I DO want browsers to cache the image, I've added the following line to my code:

self.response.headers['Cache-Control'] = "public"

According to the same page as before:

The “cache-control: public” directive [...] tells the browser and proxies [...] that the page may be cached. This is good for non-sensitive pages, as caching improves performance.

The question is if this could be harmful to the application in some way? Would it be best to send Cache-Control: must-revalidate to "force" the browser to revalidate (I suppose that is the behavior that was originally the reason behind sending Cache-Control: no-cache)

This directive insists that the browser must revalidate the page against the server before serving it from cache. Note that it implicitly lets th开发者_开发问答e browser cache the page.

---

It isn't necessary to set Cache-Control: public unless your content is protected by HTTP authentication or SSL.

Try setting Cache-Control: max-age=nn (where nn is an integer number of seconds that you'd like caches to consider the response fresh for). AppEngine should remove the no-cache.

---

See http://www.kyle-jensen.com/proxy-caching-on-google-appengine, gives a good explaination of setting cache-control headers for GAE.

---

This can not be harmful to your application, the only risk described in that page amounts to public proxies (such as the ones used by ISPs) caching your image. If the image is confidential or user specific, you don't want this to happen. In all other cases, the caching is exactly what you want.