Cache-Control and ETag: How HTTP Caching Headers Divide Their Responsibilities

·3 views

Cache-Control and ETag are two HTTP response headers that together manage browser and CDN caching, but each answers a different question. Cache-Control defines how long a cached response stays fresh without contacting the server, using directives like max-age, public, and immutable. ETag acts as a content fingerprint — typically a hash — that allows browsers to cheaply verify whether a resource has changed once the Cache-Control window expires. When a cached copy expires, the browser sends the stored ETag value in an If-None-Match request header; if the content is unchanged, the server replies with a lightweight 304 Not Modified response instead of retransmitting the full file. A practical example from an open-source OGP image generator illustrates how combining a 30-day max-age with the immutable directive eliminates revalidation requests entirely, provided the URL reliably points to unchanging content.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Prompt Injection Emerges as AI Era's SQL Injection, Demanding Architectural Fixes

The widespread adoption of large language models has introduced prompt injection, a vulnerability where malicious inputs manipulate LLM instructions, drawing close parallels to the SQL injection threats of the early web era. Unlike traditional database queries, LLMs process all input as a single unstructured text stream, making it impossible for the model to reliably distinguish between system directives and user-supplied data. This mirrors the pre-parameterization phase of SQL injection history, when developers relied on unsafe string concatenation before the industry adopted parameterized queries as a structural fix. Security experts and software architects argue that the core principle remains unchanged: never trust user input and enforce least privilege at the architectural level. Recommended defenses include layered input validation, output sanitization, and context isolation to reduce the attack surface of LLM-driven applications.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Treating Disinformation Response Like Incident Management Could Improve Accuracy

A framework borrowed from platform and SRE engineering proposes treating disinformation response the way tech teams handle system incidents — with structured evidence, documented decisions, and clear escalation paths. The approach separates raw observations from formal assessments, ensuring that earlier reasoning is not silently overwritten when new information emerges. Responders are advised to choose between corrections, prebunks, or restrained satire only when evidence meets a defined threshold, and to avoid publishing confident language where evidence is weak. A rolling six-hour review cadence is suggested for monitoring clusters, with immediate recalibration required for high-risk cases. A final pre-publication test asks whether a response risks making audiences more familiar with the false claim than with the evidence against it.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How WorldScript Studio Makes Data Preservation the Default in Local-First Apps

WorldScript Studio, an open-source browser and desktop writing tool, has implemented a strict recovery design to prevent accidental data loss in local-first software. Because no server backup exists, the app treats preservation as the default and requires narrow, explicit conditions before any destructive action is permitted. Its autosave system classifies file states before writing and issues a typed refusal — never a silent failure — if the file is malformed, from a newer build, or otherwise unexpected. Startup recovery options are computed by a single pure function that defaults to 'no' for every destructive choice, with quarantine, reset, and safe-open each permitted only for specific, audited failure types. Destructive operations are also gated behind project locks to prevent race conditions between concurrent reads and writes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mistral AI closes €3B Series D led by Samsung, valuation tops €21B

French AI startup Mistral AI announced a €3 billion Series D funding round on September 8, 2026, pushing its post-money valuation above €21 billion in what the company claims is the largest equity raise ever by a European tech firm. The round was led by South Korea's Samsung Electronics, with co-leads EQT's Scaleup Europe Fund and PSG Equity, alongside returning backers including a16z, Nvidia, ASML, and Salesforce Ventures. CEO Arthur Mensch told CNBC the company expects to surpass $1 billion in annual recurring revenue before year-end, serving over 125 enterprise clients across 20 countries. Proceeds will fund an expanding European compute infrastructure, including a Paris-area data centre housing nearly 14,000 Nvidia GPUs and a second facility in Sweden, targeting 200 MW of capacity by end-2027. While Mistral markets itself as a sovereign European AI provider, analysts note its cap table includes significant non-European capital, meaning 'sovereignty' applies to model weights and data residency rather than company ownership.

0 comments Read more at DEV Community