Double-Keyed HTTP Cache Partitioning & RFC 5861 stale-while-revalidate
- Last updated
- Prerequisites:
- HTTP headers (Cache-Control, ETag, If-None-Match)
- Cross-site tracking concepts
- browser
- http-cache
- caching
- stale-while-revalidate
- partitioning
- etag
Read at your depth
The practical view
HTTP Cache Partitioning (double-keying) isolates the browser's HTTP cache using two keys: the top-level site (e.g. `https://a.com`) and the resource URL. This stops third-party sites from tracking users across domains via shared cached files. `stale-while-revalidate` (`Cache-Control: max-age=60, stale-while-revalidate=3600`) tells the browser: 'serve the cached version instantly for up to 1 hour after it expires, while firing a background request to fetch and save the fresh version'.
The same idea in other frameworks
Vercel / Next.js Edge CDN headers emitting `s-maxage=60, stale-while-revalidate=3600`.Service Worker `ngsw-config.json` performance caching strategy mimicking SWR.Nuxt Nitro route rules setting SWR cache-control headers.SvelteKit `setHeaders({'cache-control': 'max-age=60, stale-while-revalidate=3600'})`.Legacy vs modern
Blocking Revalidation vs Stale-While-Revalidate Caching
Standard max-age=0 forces users to wait on 304 network roundtrips; stale-while-revalidate yields immediate rendering with background refresh.
Cache-Control: no-cache, must-revalidate // ❌ Blocks render on network roundtripCache-Control: public, max-age=60, stale-while-revalidate=86400 // ✅ NEW: Instant 0ms responseInterview gotchas
Context
Tests knowledge of browser privacy changes and cache partitioning.
The mechanical answer
All major browsers (Chrome, Safari, Firefox) now enforce HTTP Cache Partitioning (double-keying). The cache is keyed by both the top-level domain and the resource URL. If a user visits Site A that uses `cdnjs.com/react.js`, and then visits Site B that uses the *exact same* URL, Site B cannot read Site A's cached file and must download it again. Self-hosting assets on your own origin is now strictly faster because it avoids extra DNS resolutions and TLS handshakes.
Trap
Do not claim that shared CDNs improve cache hit rates across different websites in modern browsers. That was deprecated in 2020.
Context
Checks resilience and error handling behavior in the browser network stack.
The mechanical answer
The user who triggered the background revalidation already received the stale 200 response instantly and is unaffected. For the background failure itself, the browser leaves the existing cached entry intact (or flags it for immediate revalidation on the next attempt), preventing downstream outages from breaking the client experience.
Trap
A background SWR failure does *not* throw an error into the active webpage context.